Process skew: fingerprinting the process for anomaly detection in industrial control systems

Chuadhry Mujeeb Ahmed; Jay Prakash; Rizwan Qadeer; Anand Agrawal; Jianying Zhou

doi:10.1145/3395351.3399364

Process skew: fingerprinting the process for anomaly detection in industrial control systems

Chuadhry Mujeeb Ahmed, Jay Prakash, Rizwan Qadeer, Anand Agrawal, Jianying Zhou

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution book

12 Citations (Scopus)

Abstract

In an Industrial Control System (ICS), its complex network of sensors, actuators and controllers have raised security concerns. In this paper, we proposed a technique called Process Skew that uses the small deviations in the ICS process (herein called as a process fingerprint) for anomaly detection. The process fingerprint appears as noise in sensor measurements due to the process fluctuations. Such a fingerprint is unique to a process due to the intrinsic operational constraints of the physical process. We validated the proposed scheme using the data from a real-world water treatment testbed. Our results show that we can effectively identify a process based on its fingerprint, and detect process anomaly with a very low false-positive rate.

Original language	English
Title of host publication	WiSec'20
Subtitle of host publication	Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks
Place of Publication	New York
Pages	219-230
Number of pages	12
DOIs	https://doi.org/10.1145/3395351.3399364
Publication status	Published - 8 Jul 2020
Event	13th ACM Conference on Security and Privacy in Wireless and Mobile Networks - Duration: 6 Jul 2020 → 9 Jul 2020 Conference number: 13

Conference

Conference	13th ACM Conference on Security and Privacy in Wireless and Mobile Networks
Abbreviated title	ACM WiSec 2020
Period	6/07/20 → 9/07/20

Keywords

CPS security
critical infrastructure
cyber physical systems
sensor attacks
sensor security

Access to Document

10.1145/3395351.3399364

Cite this

@inproceedings{e6545ce8b539440f88568e5b7844e2e9,

title = "Process skew: fingerprinting the process for anomaly detection in industrial control systems",

abstract = "In an Industrial Control System (ICS), its complex network of sensors, actuators and controllers have raised security concerns. In this paper, we proposed a technique called Process Skew that uses the small deviations in the ICS process (herein called as a process fingerprint) for anomaly detection. The process fingerprint appears as noise in sensor measurements due to the process fluctuations. Such a fingerprint is unique to a process due to the intrinsic operational constraints of the physical process. We validated the proposed scheme using the data from a real-world water treatment testbed. Our results show that we can effectively identify a process based on its fingerprint, and detect process anomaly with a very low false-positive rate.",

keywords = "CPS security, critical infrastructure, cyber physical systems, sensor attacks, sensor security",

author = "Ahmed, {Chuadhry Mujeeb} and Jay Prakash and Rizwan Qadeer and Anand Agrawal and Jianying Zhou",

year = "2020",

month = jul,

day = "8",

doi = "10.1145/3395351.3399364",

language = "English",

isbn = "9781450380065",

pages = "219--230",

booktitle = "WiSec'20",

note = "13th ACM Conference on Security and Privacy in Wireless and Mobile Networks, ACM WiSec 2020 ; Conference date: 06-07-2020 Through 09-07-2020",

}

Ahmed, CM, Prakash, J, Qadeer, R, Agrawal, A & Zhou, J 2020, Process skew: fingerprinting the process for anomaly detection in industrial control systems. in WiSec'20: Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks. New York, pp. 219-230, 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks, 6/07/20. https://doi.org/10.1145/3395351.3399364

Process skew: fingerprinting the process for anomaly detection in industrial control systems. / Ahmed, Chuadhry Mujeeb; Prakash, Jay; Qadeer, Rizwan et al.
WiSec'20: Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks. New York, 2020. p. 219-230.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution book

TY - GEN

T1 - Process skew

T2 - 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks

AU - Ahmed, Chuadhry Mujeeb

AU - Prakash, Jay

AU - Qadeer, Rizwan

AU - Agrawal, Anand

AU - Zhou, Jianying

N1 - Conference code: 13

PY - 2020/7/8

Y1 - 2020/7/8

N2 - In an Industrial Control System (ICS), its complex network of sensors, actuators and controllers have raised security concerns. In this paper, we proposed a technique called Process Skew that uses the small deviations in the ICS process (herein called as a process fingerprint) for anomaly detection. The process fingerprint appears as noise in sensor measurements due to the process fluctuations. Such a fingerprint is unique to a process due to the intrinsic operational constraints of the physical process. We validated the proposed scheme using the data from a real-world water treatment testbed. Our results show that we can effectively identify a process based on its fingerprint, and detect process anomaly with a very low false-positive rate.

AB - In an Industrial Control System (ICS), its complex network of sensors, actuators and controllers have raised security concerns. In this paper, we proposed a technique called Process Skew that uses the small deviations in the ICS process (herein called as a process fingerprint) for anomaly detection. The process fingerprint appears as noise in sensor measurements due to the process fluctuations. Such a fingerprint is unique to a process due to the intrinsic operational constraints of the physical process. We validated the proposed scheme using the data from a real-world water treatment testbed. Our results show that we can effectively identify a process based on its fingerprint, and detect process anomaly with a very low false-positive rate.

KW - CPS security

KW - critical infrastructure

KW - cyber physical systems

KW - sensor attacks

KW - sensor security

U2 - 10.1145/3395351.3399364

DO - 10.1145/3395351.3399364

M3 - Conference contribution book

SN - 9781450380065

SP - 219

EP - 230

BT - WiSec'20

CY - New York

Y2 - 6 July 2020 through 9 July 2020

ER -

Process skew: fingerprinting the process for anomaly detection in industrial control systems

Abstract

Conference

Keywords

Access to Document

Fingerprint

Cite this