Embedded intrusion detection system for industrial controllers
View Patent ↗An intrusion detection system can be embedded in an industrial controller to detect an attack on an industrial control system. The intrusion detection system can detect an attack by determining if there are anomalies related to the network traffic in the industrial control system and/or by determining if the devices (e.g., sensors and actuators) connected to the industrial controllers of the industrial control system are not operating within expected ranges. To assist in determining if the devices of the industrial control system are not operating properly, the industrial controllers can also be networked together in a peer-to-peer network that permits each industrial controller to share its state information with the other industrial controllers.
1. An industrial controller for an industrial control system, the industrial controller comprising:
at least one processor;
a memory device connected to the at least one processor;
a communication interface configured to permit communications with other industrial controllers of the industrial control system; and
an intrusion detection system, the intrusion detection system having instructions that, when executed by the at least one processor, cause the at least one processor to:
receive state information about one or more devices connected to the industrial controller;
receive, from additional industrial controllers of the industrial control system via the communication interface, additional state information on additional devices connected to the additional industrial controllers; and
evaluate, with a plurality of first state estimators and one or more second state estimators, the received state information and the received additional state information to determine whether the one or more devices or the additional devices are operating within expected ranges, wherein operation of a device outside of a corresponding expected range indicates that the industrial control system is being attacked, and wherein each of the additional devices has a corresponding first state estimator of the plurality of first state estimators and each of the one or more devices has a corresponding second state estimator of the one or more second state estimators.
2. The industrial controller of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to aggregate the received state information and the received additional state information and store the aggregated state information in a stack.
3. The industrial controller of claim 2 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to retrieve the aggregated state information from the stack.
4. The industrial controller of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to determine if the one or more devices are operating outside of expected ranges and determine if the additional devices are operating outside of expected ranges.
5. The industrial controller of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to share the received state information about the one or more devices with the additional industrial controllers over a peer-to-peer network via the communication interface.
6. The industrial controller of claim 1 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to detect abnormalities in network traffic to the industrial controller.
7. The industrial controller of claim 6 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to categorize abnormalities detected by the at least one processor.
8. An industrial control system for a physical system, the industrial control system comprising:
a plurality of controllers, wherein each controller of the plurality of controllers is connected to a plurality of devices, and wherein each device of the plurality of devices is configured to monitor or control a portion of the physical system;
a network connecting the plurality of controllers to permit communication between the plurality of controllers;
each controller of the plurality of controllers comprising:
at least one processor;
a memory device connected to the at least one processor;
a communication interface configured to permit communications with other controllers of the plurality of controllers via the network; and
an intrusion detection system for detecting an attack on the industrial control system, the intrusion detection system having instructions that, when executed by the at least one processor, cause the at least one processor to:
receive state information about the plurality of devices connected to the controller;
receive, from additional controllers of the plurality of controllers via the communication interface, additional state information about devices connected to the additional controllers; and
evaluate, with a plurality of first state estimators and a plurality of second state estimators, the received state information and the received additional state information to determine whether a device is operating within an expected range, wherein operation of the device outside of a corresponding expected range indicates an attack on the industrial control system, and wherein each device of the plurality of devices connected to the controller has a corresponding first state estimator of the plurality of first state estimators and each device of the devices connected to the additional controllers has a corresponding second state estimator of the plurality of second state estimators.
9. The industrial control system of claim 8 , wherein the network is a peer-to-peer network.
10. The industrial control system of claim 9 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to share the received state information about the plurality of devices with the additional controllers of the plurality of controllers over the peer-to-peer network via the communication interface.
11. The industrial control system of claim 8 , wherein the plurality of devices includes at least one sensor and at least one actuator.
12. The industrial control system of claim 8 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to generate a predicted value for a state of at least one of the plurality of devices.
13. The industrial control system of claim 12 , wherein the instructions, when executed by the at least one processor, cause the at least one processor to determine whether the at least one of the plurality of devices is operating within the expected range based on the generated predicted value.
14. A method for detecting an attack on an industrial control system, the method comprising:
receiving, by an intrusion detection system, first state information from a plurality of first devices connected to a first industrial controller of the industrial control system, wherein the intrusion detection system is embedded in the first industrial controller;
receiving, by the intrusion detection system from one or more second industrial controllers of the industrial control system, second state information from one or more second devices connected to the one or more second industrial controllers, wherein the first industrial controller is connected to the one or more second industrial controllers by a network;
analyzing, by the intrusion detection system with a plurality of first state estimators and one or more second state estimators, the first state information and the second state information to assess whether a first device of the plurality of first devices or a second device of the one or more second devices is providing anomalous readings, wherein each first device of the plurality of first devices has a corresponding first state estimator of the plurality of first state estimators and each second device of the one or more second devices has a corresponding second state estimator of the one or more second state estimators;
determining, by the intrusion detection system, an attack on the industrial control system based on an assessment that a first device of the plurality of first devices or a second device of the one or more second devices is providing anomalous readings; and
taking action, by the intrusion detection system, to mitigate the attack on the industrial control system based on the determining.
15. The method of claim 14 , further comprising:
aggregating, by the intrusion detection system, the first state information and the second state information; and
storing, by the intrusion detection system, the aggregated information in a stack, wherein the aggregated information stored in the stack is retrieved from the stack by an anomaly detector to assess whether a first device of the plurality of first devices or a second device of the one or more second devices is providing anomalous readings.
16. The method of claim 14 , wherein analyzing the first state information and the second state information with the plurality of first state estimators and the one or more second state estimators includes generating, by each first state estimator, a first predicted value for a corresponding first device and generating, by each second state estimator, a predicted second value for a corresponding second device.
17. The method of claim 16 , wherein analyzing the first state information and the second state information with the plurality of first state estimators and the one or more second state estimators includes determining whether the first predicted value is within a first confidence interval and whether the second predicted value is within a second confidence interval.
18. The method of claim 17 , wherein analyzing the first state information and the second state information with the plurality of first state estimators and the one or more second state estimators includes determining the first confidence interval based on a predetermined number of historic values for the corresponding first device and determining the second confidence interval based on a predetermined number of historic values for the corresponding second device.
19. The method of claim 14 , further comprising communicating, by the intrusion detection system, the first state information to corresponding intrusion detection systems of the one or more second industrial controllers.