Side Channel Anomaly Detection in Industrial Control Systems Using Physical Characteristics of End Devices

Abstract

Industrial Control Systems (ICS) are described by the Department of Homeland Security as systems that are so \vital to the United States that their incapacity or destruction would have a debilitating impact on our physical or economic security. Attacks like Stuxnet show that these systems are vulnerable. The end goal for Stuxnet was to spin centrifuges at a frequency rate outside of normal operation and hide its activity from the ICS operator. This research aims to provide a proof of concept for an anomaly detection system that would be able to detect an attack like Stuxnet by measuring the physical change in vibration caused by the attack. The attack can hide what is reported to the operator, but it cannot hide the physical changes caused by the attack. This research uses a piezoelectric vibration sensor to collect vibration data coming from a centrifugal pump and ow meter on an ICS training system at each operating level. The collected data is then fingerprinted and classified using established RF-DNA techniques to determine if it can differentiate between the vibrations produced at each of the operating level. A clear differentiation between operating levels indicates that an ADS is feasible

    Similar works