Distance Concept Based Filter Approach for Detection of Cyberattacks on Industrial Control Systems

Industrial Control Systems (ICS) have become a new target of attackers since the beginning of the century. Computer worm Stuxnet proved the vulnerability of these systems to cyber-attacks. Control-command architecture is built to ensure the safety and the reliability of the system and the environment, however, several attacks or studies have underlined the lack of protection of components in an ICS. They equally proved the incomplete solutions proposed by the Information technology (IT). This paper presents an innovative approach for intrusion detection system in ICS based on the notions of states and distance between sets of states. Distance assessment over time between common and forbidden states of the system provides the prediction and discrimination of deviations. A proposed algorithm analyses orders sent to actuators continuously and enables to stop dangerous orders for the system. This study is supported by simulations inspired by classical ICS.