Physical Intrusion Detection for Industrial Control System

It is difficult to prevent attackers from intruding into the industrial control system(ICS) physically, who can connect external devices to the system to steal information or inject false data. In this paper, a physical intrusion detection method is proposed for ICS, by analyzing the communication signal at physical layer. RS485, one of the most important and widely-used serial bus, is selected to investigate how the intruded devices influence the voltage signal in ICS network. The model of voltage signal in RS485 communication lines is built to represent the difference caused by the variation of devices and detect the intruded devices. In the simulation, we demonstrate how to detect an intruded device in a two-device RS485 system.