Detecting anomalous programmable logic controller behavior using RF-based Hilbert transform features and a correlation-based verification process

International Journal of Critical Infrastructure Protection

Volumn 9, Issue , 2015, Pages 41-51

  Stone, Samuel J ^a   Temple, Michael A ^a   Baldwin, Rusty O ^b  

^a Wright Patterson Air Force Base   (United States)

^b Riverside Research   (United States)

Author keywords

Anomaly detection; Hilbert transforms; Industrial control systems; Programmable logic controllers; RF emissions

Indexed keywords

ANOMALY DETECTION; COMPUTER CIRCUITS; DIGITAL COMPUTERS; GATEWAYS (COMPUTER NETWORKS); INDUSTRIAL EMISSIONS; MATHEMATICAL TRANSFORMATIONS; NETWORK SECURITY; NETWORKED CONTROL SYSTEMS; PROGRAMMABLE LOGIC CONTROLLERS; PROGRAMMED CONTROL SYSTEMS; SCADA SYSTEMS; SIGNAL TO NOISE RATIO;

DISTRIBUTED OPERATIONS; HILBERT TRANSFORM; INDUSTRIAL CONTROL SYSTEMS; MONITORING AND CONTROL; RADIO FREQUENCY EMISSIONS; SUPERVISORY CONTROL AND DATAACQUISITION SYSTEMS (SCADA); TIME DOMAIN FEATURES; VERIFICATION METHODOLOGY;

CONTROLLERS;

EID: 84929282641     PISSN: 18745482     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.ijcip.2015.02.001     Document Type: Article

References (35)

1. D. Agrawal, S. Baktir, D. Karakoyunlu, P. Rohatgi and B. Sunar, Trojan detection using IC fingerprinting, Proceedings of the IEEE Symposium on Security and Privacy, pp. 296-310, 2007.
2. C. Aguayo Gonzalez and J. Reed, Detecting unauthorized software execution in SDR using power fingerprinting, Proceedings of the Military Communications Conference, pp. 2211-2216, 2010.
3. C. Aguayo Gonzalez and J. Reed, Power fingerprinting in SDR integrity assessment for security and regulatory compliance, Analog Integrated Circuits and Signal Processing, vol. 69(2-3), pp. 307-327, 2011.
4. W. Baranski, A. Wytyczak-Partyka and T. Walkowiak, Computational Complexity Reduction in PCA-Based Face Recognition, Technical Report, Institute of Computer Engineering, Control and Robotics, Wroclaw University of Technology, Wroclaw, Poland, 2007.
5. G. Bush, Homeland Security Presidential Directive 7, The White House, Washington, DC, 2003.
6. G. Chow and A. Jones, Framework for anomaly detection in OKL4-Linux based smartphones, Proceedings of the Sixth Australian Information Security Management Conference, pp. 29-39, 2006.
7. W. Cobb, E. Laspe, R. Baldwin, M. Temple and Y. Kim, Intrinsic physical-layer authentication of integrated circuits, IEEE Transactions on Information Forensics and Security, vol. 7(1), pp. 14-24, 2012.
8. G. DeJean and D. Kirovski, Radio-frequency certificates of authenticity, Proceedings of the Ninth International Workshop on Cryptographic Hardware and Embedded Systems, pp. 346-363, 2007.
9. J. Downie and J. Walkup, Optimal correlation filters for images with signal-dependent noise, Journal of the Optical Society of America A, vol. 11(5), pp. 1599-1609, 1994.
10. R. Duda, P. Hart and D. Stork, Pattern Classification, John Wiley and Sons, New York, 2001.
11. K. Ellis and N. Serinken, Characteristics of radio transmitter fingerprints, Radio Science, vol. 36(4), pp. 585-597, 2001.
12. L. Gauthier, S. Yoo and A. Jerraya, Automatic generation and targeting of application-specific operating systems and embedded systems software, IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 20(11), pp. 1293-1301, 2001.
13. S. Hahn, Chapter 7: Hilbert transforms, in The Transforms and Applications Handbook, A. Poularikas (Ed.), CRC Press, Boca Raton, Florida, 2010.
14. P. Harmer, D. Reising and M. Temple, Classifier selection for physical layer security augmentation in cognitive radio networks, Proceedings of the IEEE International Conference on Communications, pp. 2846-2851, 2013.
15. T. Ho and M. Basu, Complexity measures of supervised classification problems, IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 24(3), pp. 289-300, 2002.
16. A. Jain, A. Ross and S. Prabhakar, An introduction to biometric recognition, IEEE Transactions on Circuits and Systems for Video Technology, vol. 14(1), pp. 4-20, 2004.
17. W. Keller and B. Pathak, Integrated Circuit with Electromagnetic Energy Anomaly Detection and Processing, U.S. Patent 20120223403, 2012.
18. R. Klein, M. Temple, M. Mendenhall and D. Reising, Sensitivity analysis of burst detection and RF fingerprinting classification performance, Proceedings of the IEEE International Conference on Communications, 2009.
19. P. Kocher, J. Jaffe and B. Jun, Differential Power Analysis, Technical Report, Cryptography Research, San Francisco, California, 1998.
20. McAfee Labs, 2013 Threats Predictions, Technical Report, Santa Clara, California, 2012.
21. B. Obama, Executive Order 13636: Improving Critical Infrastructure Cybersecurity, The White House, Washington, DC, 2013.
22. A. Potamianos and P. Maragos, A Comparison of the Energy Operator and the Hilbert Transform Approach to Signal and Speech Demodulation, Technical Report, School of Electrical and Computer Engineering, Georgia Institute of Technology, Atlanta, Georgia, 1995.
23. J. Proakis, Digital Communications, McGraw-Hill, New York, 2000.
24. D. Reising, M. Temple and M. Mendenhall, Improved wireless security for GMSK-based devices using RF fingerprinting, International Journal of Electronic Security and Digital Forensics, vol. 3(1), pp. 41-59, 2010.
25. K. Selvamani, S. Anbuchelian, S. Kanimozhi, R. Elakkiya, S. Bose and A. Kannan, A hybrid framework of intrusion detection system for resource consumption based attacks in wireless ad hoc networks, Proceedings of the International Conference on Systems and Informatics, pp. 8-12, 2012.
26. S. Stone and M. Temple, RF-based anomaly detection for PLCs in critical infrastructure applications, International Journal of Critical Infrastructure Protection, vol. 5(2), pp. 66-73, 2012.
27. S. Stone, M. Temple and R. Baldwin, RF-based PLC IC design verification, presented at the Diminishing Manufacturing Sources and Material Shortages and Standardization Conference, 2012.
28. Symantec, W32.Duqu: The Precursor to the Next Stuxnet, version 1.4, Technical Report, Mountain View, California, 2011.
29. V. Tiwari, S. Malik, A. Wolfe and M. Lee, Instruction level power analysis and optimization of software, Journal of VLSI Signal Processing, vol. 13(2-3), pp. 223-238, 1996.
30. U.S. Congress, USA PATRIOT Act of 2001, Public Law 107-56, Washington, DC, 2001.
31. T. Watley, Memorandum for LDRD Proposal Review Committee, Air Force Civil Engineer Center, Joint Base San Antonio - Lackland, San Antonio, Texas, 2012.
32. M. Williams, S. Munns, M. Temple and M. Mendenhall, RF-DNA fingerprinting for airport WiMax communications security, Proceedings of the Fourth International Conference on Network and System Security, pp. 32-39, 2010.
33. M. Williams, M. Temple and D. Reising, Augmenting bit-level network security using physical layer RF-DNA fingerprinting, Proceedings of the IEEE Global Telecommunications Conference, 2010.
34. K. Zetter, How digital detectives deciphered Stuxnet, the most menacing malware in history, Wired, July 11, 2011.
35. H. Zimmermann, OSI reference model - The ISO model of architecture for open systems interconnection, IEEE Transactions on Communications, vol. 28(4), pp. 425-432, 1980.