Towards a unified approach to detection of faults and cyber-attacks in industrial installations

Abstract

This paper investigates enhancing the ability to detect cyber-attacks by using information and methods related to fault detection. An experimental stand, and an associated simulator have been constructed to enable tests of combined cyber attacks and faults in industrial processes, and, possibly, to distinguish between them. Some scenarios of cyber attacks have been presented, analysed theoretically and then tested on the simulator, demonstrating that detection of cyber attacks by this method is possible.

Stealthy Cyberattacks Detection Based on Control Performance Assessment Methods for the Air Conditioning Industrial Installation

“…The ability to differentiate between cyber-faults and process faults is a crucial issue that warrants further examination. The CPA method presented in this article can be compared with a methodology and example described in [6], where cyberattack detection was conducted utilizing algorithms designed to detect and isolate process faults based on the analysis of residuals (Fault Isolation System-FIS). In instances of cyberattacks, the identification of diagnostic signal patterns for individual scenarios can prove to be a challenging task.…”

“…In instances of cyberattacks, the identification of diagnostic signal patterns for individual scenarios can prove to be a challenging task. Therefore, various extensions have been proposed to address this: multiple symptom assessment, symptom onset timing, and symptom sequence [6]. In such cases, the main advantage of the CPA method is its simplicity, as it requires signal analysis only without prior identification of the cause-effect relationships, complicated modelling, and residual analysis, as in the case of FIS extensions.…”

“…Until recently, the issues of detecting anomalies were carried out independently as Intrusion Detection Systems (IDS) in case of cyberattacks (security) or Advanced Diagnostic Systems (ADS) in case of technical faults (safety). However, cyberattacks in the ICS can currently be seen as an anomaly generator [6]. Considering the industrial process specificity, process model, and controller performance, the ADS should be equipped with the methods to detect and distinguish cyberattacks and process faults in OT infrastructure, thus working in parallel and exchanging information with IDS [7].…”

Multivariate alarm systems to recognize rare unpostulated abnormal events

“…28 In related work, a unified approach was developed to detect faults and cyberattacks in industrial installations. 29 Comprehensive comparisons and review of various FDD techniques can be found in several sources. [30][31][32][33][34] However, despite significant contributions, most of the existing review articles do not focus much on the relationships among FDD, RA, and ASM.…”

Stealthy Cyberattacks Detection Based on Control Performance Assessment Methods for the Air Conditioning Industrial Installation

“…Until recently, the issues of detecting anomalies were carried out independently as Intrusion Detection Systems (IDS) in case of cyberattacks (security) or Advanced Diagnostic Systems (ADS) in case of technical faults (safety). However, cyber-attacks in the ICS can currently be seen as an anomaly generator [6]. Considering the industrial process specificity, process model and controller performance, the ADS should be equipped with the methods to detect and distinguish cyberattacks and process faults in OT infrastructure, thus working in parallel and exchanging information with IDS [7].…”