Grounds for Suspicion: Physics-Based Early Warnings for Stealthy Attacks on Industrial Control Systems

Stealthy attacks on Industrial Control Systems can cause significant damage while evading detection. In this article, instead of focusing the detection stealthy attacks, we aim to provide early warnings operators, in order avoid physical and preserve advance data that may serve as an evidence during investigation. We propose a framework xmlns:xlink="http://www.w3.org/1999/xlink">grounds for suspicion , i.e., preliminary indicators reflecting likelihood success attack. two grounds suspicion based behaviour process: (i) xmlns:xlink="http://www.w3.org/1999/xlink">feasibility attack, (ii) xmlns:xlink="http://www.w3.org/1999/xlink">proximity unsafe operating regions. metric measure real-time soundness principles ensure such is consistent with suspicion. apply our Linear Time-Invariant (LTI) systems formulate computation reachability problem. validate case study involving benchmark Tennessee-Eastman process. show through numerical simulation well before potential attack damage, incurring minimal load network. Finally, use illustrate its usefulness supporting collection.