Null is Not Always Empty: Monitoring the Null Space for Field-Level Anomaly Detection in Industrial IoT Environments

Industrial environments have vastly changed since the conception of initial primitive and isolated networks. The current full interconnection paradigm, where connectivity between different devices and the Internet has become a business necessity, has driven device interconnectivity towards building the Industrial Internet of Things (IIoT), enabling added value services such as supply chain optimization or improved process control. However, whereas interconnectivity has increased, IIoT security practices has not evolved at the same pace, due partly to inherited security practices from when industrial networks where not connected and the existence of basic hardware with no security functionalities. In this work, we present an Anomaly Detection System for industrial environments that monitors physical quantities to detect intrusions. It is based in the null space detection, which is at the same time, based on Stochastic Subspace Identification (SSI). The approach is validated using the Tennessee-Eastman chemical process.