Cross-layer anomaly detection in industrial control networks

A system of detecting an anomaly in operation of an industrial control system (ICS), the system comprising a processing circuitry configured to:

• a) receive first data, the first data being derivative of signaling between a logic controller (LC) and an associated sensing/actuating component, wherein the signaling was detected by a sensor/actuator I/O line signal monitor that is operably connected to a line of communication between a sensing/actuating component and an LC of the ICS;
• b) receive second data derivative of at least one of:
• i) one or more ICS network control packets,
• ii) one or more statuses logged by an ICS application, and
• iii) one or more commands entered to an ICS application;
• and
• c) determine whether there is inconsistency between the first data and the second data.

A computer program product comprising a computer readable non-transitory storage medium containing program instructions, which program instructions when read by a processing circuitry, cause the processing circuitry to perform a method detecting an anomaly in operation of an industrial control system (ICS), the method comprising:

• a) receiving first data, the first data being derivative of signaling between a logic controller (LC) and an associated sensing/actuating component, wherein the signaling was detected by a sensor/actuator I/O line signal monitor that is operably connected to a line of communication between a sensing/actuating component and an LC of the ICS;
• b) receiving second data derivative of at least one of:
• i) one or more ICS network control packets,
• ii) one or more statuses logged by an ICS application, and
• iii) one or more commands entered to an ICS application;
• and
• c) determining whether there is inconsistency between the first data and the second data.