Adepu and Mathur detect attacks that compromise two or more sensors or actuators in the same stage of a water treatment plant at once (single-stage multipoint, SSMP). An attacker who controls enough of one stage can feed its controller a consistent false picture, so the local controller cannot see the attack. The defence uses physical invariants derived from the plant design, and places detection code on several controllers: because water flows from one stage to the next, a neighbouring stage’s controller can notice that what arrives does not match what the attacked stage claims to send.
Findings
From the abstract (I have not read the full text):
- Evaluated on an operational water treatment testbed with 42 sensors and actuators (SWaT).
- The authors report high effectiveness against a variety of SSMP attacks and say the experiments also show the method’s limitations.
- Spreading detection over controllers is argued to help scalability.
- The journal follow-up, “Distributed Attack Detection in a Water Treatment Plant: Method and Case Study” (IEEE TDSC, online 2018), names the method DAD: monitors implement invariants that must hold always or in a given plant state, and it is reported effective against stealthy and coordinated attacks on SWaT.
Limits
- Stage seedling: abstracts only, so I cannot list the failure cases the authors mention.
- Invariants come from a known, fixed design. A process that changes, or one with no design documents, needs another source of invariants (see data-centric invariants and INVARLLM).
- An attacker who also controls the neighbouring stage defeats the cross-stage check; the method targets attacks confined to one stage.
Relevance
The cross-stage idea uses one part of the plant as an independent witness for another, which is the general shape of most attack detection that works. It is a direct ancestor of the invariant-based checks in cyber-physical security.