Self detecting devices are under development for SCADA systems. A prototype lets SCADA devices police one another in order to catch and cut off a power plant or factory floor device that has suffered a compromise.
A new algorithm can detect devices not conducting their usual work. The secure distributed control program can work within SCADA systems, such as robots or PLCs, with embedded software. The software, developed by researchers at North Carolina State University, detects and then isolates a compromised device.
This software uses a reputation manager for the devices, so if one robot or PLC starts doing something it’s not supposed to do, or it even exceeds a certain threshold such as improperly accelerating or slowing its speed, other robots or devices can detect the uncharacteristic behavior, sound an alarm, and cut it off from their operations to minimize or stop any damage.
This peer-level SCADA security would augment existing and emerging SCADA security products and features, the researchers said. The algorithm could add into existing software in control systems, with some minor coding modifications, the researchers said.
“Commercial SCADA security uses a police car and travels and monitors the area. Ours is more like a community [neighborhood] watch,” said Mo-Yuen Chow, a professor of electrical and computer engineering at NC State and co-author of research on the subject. “Each of the devices watch each other and talk to [their] neighbor.”
It’s a next-generation security technology for those that truly understand they will suffer a breach. This will help minimize the damage.
“Our [technology] assumes the attack is already [occurring] and the device is already compromised,” said Wente Zeng, an NC State Ph.D. student who worked on the prototype. “After that, it [focuses on] how can we still make sure the rest of the system can work well” and uninterrupted, he said.
Each local SCADA device monitors the others so if one device behaves abnormally, the others shut down its communications, Zeng said. “So we can isolate the attack from the system.”
The researchers ran a simulation with robots containing the embedded software and controller.
“If one robot is compromised, it will affect other robots, so some of them would go to the wrong place,” Zeng said. “With our code, each is monitoring each other, so if this robot behaves weirdly,” it is cut off. “There’s a controller on the robot … and they talk to each other with the simple algorithm.”
The researchers said they plan to patent the algorithm and explore commercialization prospects for the technology.
Distinguishing between normal and abnormal behavior isn’t always so straightforward, and sophisticated attackers could find ways to taint the information in some way, according to some security experts.
Click here to read the researchers’ technical paper, “Convergence and Recovery Analysis of the Secure Distributed Control Methodology for D-NCS.”