Anomaly Detection Based on Temporal Behavior Monitoring in Programmable Logic Controllers

As Programmable Logic Controllers (PLCs) are increasingly connected and integrated into the industrial Internet of things, cybersecurity threats to PLCs also increasing. Adversaries can perform a denial service (DoS) attack based on transmission large number network packets, control-logic injection through sophisticated packet transmission. We propose an approach detecting defending against attacks that exploit security vulnerabilities in PLC system. In order protect indiscriminate uncontrolled resource consumption vulnerabilities, abnormal temporal behavior detection method is proposed monitors CPU usage tasks. If anomaly detected, tries detect control-flow anomalies by examining sequences function calls, then detects stack-based buffer overflow attacks. The implemented water tank control system for evaluation purposes. experimental results show improve with little overhead.