Method and system for detecting intrusions in industrial control systems

A system for detecting intrusions in industrial control systems, comprising:

• one or more hardware processors;
• and
• a memory coupled to the one or more hardware processors, wherein the memory comprises a plurality of modules executable by the one or more hardware processors, and wherein the plurality of modules comprises:
• model parameter training module configured to generate predetermined parameters including projection matrices, aggregation matrices, and decision boundaries;
• a data processing module configured to:
• receive real-time sensor measurements from a plurality of sensors;
• generate a plurality of lag vectors from the received sensor measurements;
• a real-time mapping module configured to:
• map the lag vectors into a noise-free signal subspace using the predetermined projection matrices;
• aggregate the mapped lag vectors into an aggregated signal subspace using the aggregation function, wherein the aggregation function is generated using the predefined predetermined aggregation matrices;
• a scoring module configured to:
• compute a plurality of departure scores for each of the aggregated lag vectors using the predetermined decision boundary;
• aggregate the plurality of departure scores to perform a smoothing on the aggregated departure scores;
• an alert generation module configured to generate an alert when the smoothed departure score exceeds a predetermined threshold.

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to execute operations of:

• generating predetermined parameters for detection, including projection matrices, aggregation matrices, and decision boundaries;
• receiving real-time sensor measurements from a plurality of sensors;
• generating a plurality of lag vectors from the received sensor measurements;
• mapping the lag vectors into a noise-free signal subspace using the predetermined projection matrices;
• aggregating the mapped lag vectors into an aggregated signal subspace using an aggregation function, wherein the aggregation function is generated using the generated predetermined aggregation matrices;
• computing a plurality of departure scores for each of the aggregated feature vectors using the predetermined decision boundaries;
• and
• aggregating the plurality of departure scores to perform a smoothing on the aggregated departure scores;
• and
• generating an alert when the smoothed departure score exceeds a predetermined threshold.