PCAT: PLC Command Analysis Tool for automatic incidence response in Water Treatment Plants

A cyber-physical attack against critical infrastructures, such as water treatment and distribution plants, could lead to process anomalies. Several design and data centric approaches were developed to detect such anomalies when the physical processes of the underlying plant move from a normal to a malicious state. Although these approaches are necessary for the continued and reliable plant operation, they might not be sufficient to prevent service disruption or damage to components. This is because the impact of anomalies is already realized before the attack is detected. In this paper, we propose PCAT – PLC Command Analysis Tool that validates the control commands issued by the programmable logic controller (PLC). PCAT stops rogue attack commands before they reach the target actuators. In a case study, PCAT was deployed and validated on the operational water treatment plant named SWaT. The experimental results attest the performance of PCAT in ensuring the security, safety, and service status of the plant before it enters an anomalous state.