With the increasing application of digital technologies in I&C systems, traditional protection strategy that depends on physical isolation is not enough. The I&C system is a type of cyber physical system, so it faces cyber security problems. Difficulties of cyber security in I&C systems are in three aspects. First, because I&C systems connect with process devices, cyber security of I&C systems requires high real-time performance. Second, I&C systems need to operate continuously, so prevention or detection approaches in I&C systems must minimize their impacts on operating I&C systems. The third one is that the consequences of cyber-attacks on I&C systems may be serious. It may not only influence the I&C systems but can also damage the nuclear reactor. Therefore, the cyber security strategies of I&C systems should be high real-time, careful and effective. There are a large number of network packets generated in the network traffic of the I&C systems. There are many attributes of the network traffic can used for anomaly detection. The structure of the network packets is analyzed in detail with examples. Then, Features are extracted from network packets. An unsupervised neural network called autoencoder is applied for anomaly detection. Training and testing database are captured from a physical PLC system which simulates a water level control system. The result of the test results shows that the neural network can detect anomaly successfully.Cyber security risk analysis includes two parts. The first one is to analyze weak points of the system, through which attackers can invade into the center of the system. The second part is to analysis the risk from outside, including different kinds of invasion methods. After analyzing potential risks, a risk classification method is proposed. Risks are given different risk level. Depending on different risk of invasions, anomaly detection and response are more convenient to be developed.


Anomaly Detection for Network Traffic of I&C Systems Based on Neural Network

Division / Sponsors: 
Power Division & Nuclear Engineering Division (NED)

Power Conference
Paper Proceedings: https://asmedigitalcollection.asme.org/POWER/POWER2020/volume/83747

International Conference on Nuclear Engineering
Paper Proceedings: https://asmedigitalcollection.asme.org/ICONE/ICONE2020/volume/83761

POWER-ICONE - Virtual Conference

Supporting the need among researchers worldwide for additional online and multimedia content, ASME now offers the ASME Conference Video Collection. This platform will collect and provide long-term access to conference presentation videos, encompassing all technology areas within ASME's technical conference and events program. About 30,000-40,000 engineers across all mechanical engineering and related disciplines participate in ASME conferences each year. This includes authors of approximately 6,000 to 8,000 technical papers published by ASME, the majority of whom also submit video presentations for our virtual conferences. The video collection will be available as an add-on to existing product packages or as a separate subscription.