Embedded intrusion detection system for industrial controllers

An industrial control system for a physical system, the industrial control system comprising:

• a plurality of controllers, wherein each controller of the plurality of controllers is connected to a plurality of devices, and wherein each device of the plurality of devices is configured to monitor or control a portion of the physical system;
• a network connecting the plurality of controllers to permit communication between the plurality of controllers;
• each controller of the plurality of controllers comprising:
• at least one processor;
• a memory device connected to the at least one processor;
• a communication interface configured to permit communications with other controllers of the plurality of controllers via the network;
• and
• an intrusion detection system for detecting an attack on the industrial control system, the intrusion detection system having instructions that, when executed by the at least one processor, cause the at least one processor to:
• receive state information about the plurality of devices connected to the controller;
• receive, from additional controllers of the plurality of controllers via the communication interface, additional state information about devices connected to the additional controllers;
• and
• evaluate, with a plurality of first state estimators and a plurality of second state estimators, the received state information and the received additional state information to determine whether a device is operating within an expected range, wherein operation of the device outside of a corresponding expected range indicates an attack on the industrial control system, and wherein each device of the plurality of devices connected to the controller has a corresponding first state estimator of the plurality of first state estimators and each device of the devices connected to the additional controllers has a corresponding second state estimator of the plurality of second state estimators.

A method for detecting an attack on an industrial control system, the method comprising:

• receiving, by an intrusion detection system, first state information from a plurality of first devices connected to a first industrial controller of the industrial control system, wherein the intrusion detection system is embedded in the first industrial controller;
• receiving, by the intrusion detection system from one or more second industrial controllers of the industrial control system, second state information from one or more second devices connected to the one or more second industrial controllers, wherein the first industrial controller is connected to the one or more second industrial controllers by a network;
• analyzing, by the intrusion detection system with a plurality of first state estimators and one or more second state estimators, the first state information and the second state information to assess whether a first device of the plurality of first devices or a second device of the one or more second devices is providing anomalous readings, wherein each first device of the plurality of first devices has a corresponding first state estimator of the plurality of first state estimators and each second device of the one or more second devices has a corresponding second state estimator of the one or more second state estimators;
• determining, by the intrusion detection system, an attack on the industrial control system based on an assessment that a first device of the plurality of first devices or a second device of the one or more second devices is providing anomalous readings;
• and
• taking action, by the intrusion detection system, to mitigate the attack on the industrial control system based on the determining.