Intrusion detection via semantic fuzzing and message provenance

An intrusion detection system for protecting against sequences of operationally valid control messages that in combination harm or disrupt devices in an operational control system comprising multiple devices, the intrusion detection system including a processor and a memory having instructions executable by the processor, causing the processor to:

• poll one or more of the multiple devices to obtain current contextual information which includes a set of physical constraints on control system properties;
• determine system-level correlations between different pairwise connections across the multiple devices based on operationally valid control messages and the current contextual information;
• generate, based on the system-level correlations, a history of message sequences between the devices of the operational control system, and the current contextual information, a plurality of candidate sequences of operationally valid control messages;
• determine a subset of one or more candidate sequences of the plurality of candidate sequences of operationally valid control messages that would result in actual harm based on an operational effect to the operational control system from each candidate sequence of operationally valid control messages;
• and
• monitor operationally valid control messages communicated in the operational control system to report a threat when a harmful sequence of messages is identified matching at least one of the subset of one or more candidate sequences of operationally valid control messages that would result in actual harm.

An intrusion detection method for protecting against sequences of operationally valid control messages that in combination harm or disrupt devices in an operational control system comprising multiple devices, the method comprising:

• polling one or more of the multiple devices to obtain contextual information including a set of physical constraints on control system properties;
• mapping message provenance by determining system-level correlations between different pairwise connections across the multiple devices based on operationally valid control messages and the current contextual information;
• generating, based on the system-level correlations, a history of message sequences between the devices of the operational control system, and the current contextual information, a plurality of candidate sequences of operationally valid control messages;
• evaluating harmfulness of the plurality of candidate sequences of operationally valid control messages using one or more behavior oracles to determine a subset of one or more candidate sequences that would result in actual harm;
• and
• monitoring the operationally valid control messages communicated in the operational control system to generating a threat report when a harmful sequence of messages is identified matching at least one candidate sequence of the subset of one or more candidate sequences of operationally valid control messages that would result in actual harm.