Controller Cyber-Attack Detection and Isolation

Abstract

This article deals with the cyber security of industrial control systems. Methods for detecting and isolating process faults and cyber-attacks, consisting of elementary actions named “cybernetic faults” that penetrate the control system and destructively affect its operation, are analysed. FDI fault detection and isolation methods and the assessment of control loop performance methods developed in the automation community are used to diagnose these anomalies. An integration of both approaches is proposed, which consists of checking the correct functioning of the control algorithm based on its model and tracking changes in the values of selected control loop performance indicators to supervise the control circuit. A binary diagnostic matrix was used to isolate anomalies. The presented approach requires only standard operating data (process variable (PV), setpoint (SP), and control signal (CV). The proposed concept was tested using the example of a control system for superheaters in a steam line of a power unit boiler. Cyber-attacks targeting other parts of the process were also included in the study to test the proposed approach’s applicability, effectiveness, and limitations and identify further research directions.

The Best Scenario of Cyber Attack Selecting on the Information and Communication System Based on the Logical and Probabilistic Method

“…To move to the probabilistic form (3), let's write (6) in the form (7) 6. Let's write by replacing Z i in (7) with and get the function of the probability of success of the attack scenario J : J 7. Based on relation (8) and the known probabilities of capturing objects , we will calculate a set of criteria for the probability of success of network attack scenarios J , J , …, J for each of possible attacks ; 8.…”

“…Therefore, a lot of research is devoted to the issue of analyzing attack scenarios. In works [5]- [7], scenarios of attacks on ICS are analyzed, various approaches to the implementation of such attacks are considered. When analyzing scenarios, it is important to choose a methodology for describing attacks on information systems, in particular methods for describing trajectories and quantifying the effectiveness of attacks.…”