From Design to Invariants: Detecting Attacks on Cyber Physical Systems

An approach is proposed to derive state-based invariants that, when programmed into a controller, proved to be effective in detecting cyber attacks on an Industrial Control System (ICS). The proposed approach begins with the ICS design and models its process dynamics using an extended hybrid automata from which the invariants are derived. Each invariant is programmed and inserted into an appropriate Programmable Logic Controller (PLC) as a companion to the control code. The invariant is active during ICS operation and serves to check on the validity of the system state in accordance with the system design. This approach, referred to as D2I for Design to Invariants, was evaluated on a fully operational 6-stage water treatment plant that uses a distributed process control system.