Non-intrusive replay attack detection system

A system to identify a replay attack in an industrial control system of an industrial asset, comprising:

• one or more first monitoring nodes at a first location within an enclosure of the industrial control system;
• and
• an attack detector, coupled to the one or more first monitoring nodes, configured to:
• receive a first set of time series data associated with an ambient condition of one or more first monitoring nodes at the first location of the industrial control system, the first set of time series data comprising first data values obtained during a particular time period;
• determine an actual system feature value for the industrial asset based upon the first set of time series data;
• receive a second set of time series data indicative of the ambient condition at a second location external to the enclosure of the industrial control system, the second set of time series data comprising second data values obtained during the particular time period;
• determine a nominal system feature value based upon the second set of time series data;
• analyze a correlation between the actual feature value and the nominal system feature value to determine a correlation result;
• and
• selectively categorize a request received by the industrial control system as a replay attack based upon the correlation result.