Umer and colleagues compare two ways to get the invariants that an attack detector checks in a water treatment plant. Design-centric invariants are written by hand from the plant’s design and physics. Data-centric invariants are mined from operational logs with association rule mining. The study runs both on the same scaled-down operational plant (SWaT) and compares how well each set detects anomalies, using a design-centric method from the literature as the baseline.
Findings
From the abstract and the earlier workshop version (I have not read the full text):
- The 2017 workshop version (CPS-SPC 2017, “Integrating Design and Data Centric Approaches to Generate Invariants for Distributed Attack Detection”) concludes that neither approach is adequate alone and the two should be integrated.
- Data-centric mining is pitched for legacy plants where design-level invariants are hard to derive.
Limits
- Stage seedling: I have no numbers for detection rates or false alarms.
- Association rules learned from normal operation only describe states the plant visited during logging. Rare but legitimate states can raise false alarms, and an attacker who stays inside learned rules is invisible.
- Both approaches assume a mostly fixed process. A mobile robot’s “plant” changes with terrain, payload and weather.
Relevance
The choice between invariants written from the design and rules mined from logs comes back on any machine with a physical process, robots included. See cyber-physical security, runtime monitoring, and the two neighbours of this note, design-derived invariants and LLM-drafted invariants.