Multi-Dimensional Data Fusion Intrusion Detection for Stealthy Attacks on Industrial Control Systems

The security of Industrial Control Systems (ICS) is closely related to national security. With secret exploration and analysis of a target ICS, highly-skilled attackers can gain enough key knowledge about the system (e.g., the physical model of the system and the corresponding detection threshold), and then launch stealthy attacks by keeping the detection indicator under its threshold, thus bypasses existing intrusion detection mechanisms. However, we discover that all devices in industrial control systems consume energy at run time and the energy consumption varies according to different operation types and system states. Therefore, there exists relationships between control operation, system state and energy consumption of the device. Accordingly, we put forward a novel ICS intrusion detection approach based on multi-dimensional data fusion. This approach collects information about power consumption of physical devices, control operation and system state, and then identifies stealthy attacks by feeding the multi-dimensional information into a cascade detection algorithm. Experimental results verify that our approach has a better detection performance than other detection methods.