System and method for cyber attack detection based on rapid unsupervised recognition of recurring signal patterns

A method for cyber-attack detection within cyber-physical systems, the method comprising acts of:

• obtaining a time-varying analog side-channel signal from components with a cyber-physical system;
• converting the time-varying analog side-channel signal to a digital side-channel signal;
• identifying a time-series of system states based on the digital side-channel signal;
• comparing the time-series of system states with software states as generated by cyber-physical system components, such that when the software states are unmatched with the time-series of system states, designating a side-channel security breach;
• and
• causing the cyber-physical system to implement an action based on the side-channel security breach.

A computer program product for cyber-attack detection within cyber-physical systems, the computer program product comprising:

• a non-transitory computer-readable medium having executable instructions encoded thereon, such that upon execution of the instructions by one or more processors, the one or more processors perform operations of:
• obtaining a time-varying analog side-channel signal from components with a cyber-physical system;
• converting the time-varying analog side-channel signal to a digital side-channel signal;
• identifying a time-series of system states based on the digital side-channel signal;
• comparing the time-series of system states with software states as generated by cyber-physical system components, such that when the software states are unmatched with the time-series of system states, designating a side-channel security breach;
• and
• causing the cyber-physical system to implement an action based on the side-channel security breach.