Abstract:Industrial control systems (ICSs) are widely used in critical infrastructures, making them popular targets for attacks to cause catastrophic physical damage. As one of the most critical components in ICSs, the programmable logic controller (PLC) controls the actuators directly. A PLC executing a malicious program can cause significant property loss or even casualties. The number of attacks targeted at PLCs has increased noticeably over the last few years, exposing the vulnerability of the PLC and the importance of PLC protection. Unfortunately, PLCs cannot be protected by traditional intrusion detection systems or antivirus software. Thus, an effective method for PLC protection is yet to be designed. Motivated by these concerns, we propose a non-invasive powerbased anomaly detection scheme for PLCs. The basic idea is to detect malicious software execution in a PLC through analyzing its power consumption, which is measured by inserting a shunt resistor in series with the CPU in a PLC while it is executing instructions. To analyze the power measurements, we extract a discriminative feature set from the power trace, and then train a long short-term memory (LSTM) neural network with the features of normal samples to predict the next time step of a normal sample. Finally, an abnormal sample is identified through comparing the predicted sample and the actual sample. The advantages of our method are that it requires no software modification on the original system and is able to detect unknown attacks effectively. The method is evaluated on a lab testbed, and for a trojan attack whose difference from the normal program is around 0.63%, the detection accuracy reaches 99.83%.

Malicious Code Detection Scheme Based on CWRNN for Microgrid Controllers

Malicious Code Detection on Smart Meters -A Side-Channel Based Approach

A Microgrid Controller Security Monitoring Model Based on Message Flow

Real-time Monitoring of Smart Grid Terminals Based on Multi-dimensional Information Fusion

Anomoly Detection for PLC Based on Magnetic Side Channel

Power Consumption-based Anomaly Detection for Relay Protection

Power IoT System Security Monitoring Based on Power Consumption Side Channel Information.

Vulnerability Detection For Smart Grid Devices Via Static Analysis

ADDP: Anomaly Detection for DTU Based on Power Consumption Side-Channel

Attack Detection for Distributed Photovoltaic Generation Systems Leveraging Cyber and Power Side Channel Data

NIPAD: a Non-Invasive Power-Based Anomaly Detection Scheme for Programmable Logic Controllers

On-line Detection of Malicious Activities Based on Edge Computing in Micro-grid System

Power-Based Non-Intrusive Condition Monitoring for Terminal Device in Smart Grid

Using Power Side-Channel to Implement Anomaly-Based Intrusion Detection on Smart Grid Terminals

Intrusion Detection Algorithm of Power Grid Industrial Control System Based on CNN

Optimal Distributed Cooperative Control Strategy for Frequency Restoration in AC Microgrid under Malicious Attacks

Deep Learning-Based Cyber Attack Detection in Power Grids with Increasing Renewable Energy Penetration

Power-Grid Controller Anomaly Detection with Enhanced Temporal Deep Learning

Event-Based Attack Detection and Mitigation for DC Microgrids via Adaptive LQR Approach

Improving IIoT security: Unveiling threats through advanced side-channel analysis

Codesign of FDI Attacks Detection, Isolation, and Mitigation for Complex Microgrid Systems: An HBF-NN-Based Approach