Model Based Anomaly Detection Focused on the Operating States

Recently whitelist has been drawing attention as a protection method of Industrial Control Systems (ICS) against cyber attacks. In this paper, we propose a whitelist type detection method focused on operating states of ICS. The method introduces operating states estimation using multiple control devices information. It is expected to detect impersonation attacks which typical whitelist type detections are not good at. To verify the validity of the proposed method, we consider three attack scenarios using a simulation model of the gas-liquid plant control.