Detecting intrusions in control systems: a rule of thumb, its justification and illustrations

TL;DR

This paper introduces a practical rule of thumb for detecting disruptions in control systems, supported by theoretical justification and illustrative examples, aiming to improve intrusion detection methods.

Contribution

It proposes a new, justified rule of thumb for intrusion detection in control systems and discusses its theoretical basis and potential for broader application.

Findings

The rule effectively detects various disruptions.

Theoretical analysis clarifies the rule's applicability.

Illustrative examples demonstrate practical use.

Abstract

Control systems are exposed to unintentional errors, deliberate intrusions, false data injection attacks, and various other disruptions. In this paper we propose, justify, and illustrate a rule of thumb for detecting, or confirming the absence of, such disruptions. To facilitate the use of the rule, we rigorously discuss background results that delineate the boundaries of the rule's applicability. We also discuss ways to further widen the applicability of the proposed intrusion-detection methodology.