A Physical Fingerprint-Based Intrusion Detection and Localization in Fieldbus Network

Abstract

The security of fieldbus networks is of utmost importance for industrial control systems. Within fieldbus networks, masquerade attacks and illegal device intrusions are two prevalent forms of attacks. The detection of these attacks is particularly challenging due to the sophisticated masquerading and deception techniques employed by attackers. To address the challenges of masquerade attacks and illegal device intrusions in fieldbus networks, this paper presents an intrusion detection and localization method based on physical fingerprints. The method involves constructing a physical fingerprint model for each device by collecting voltage signals transmitted in the fieldbus network and extracting relevant time-domain and frequency-domain features from these signals. Additionally, a predictive score detection mechanism is proposed, incorporating a multi-label SVM classification model to accurately identify masquerade attacks and illegal device intrusions within the network. Furthermore, the method utilizes differential delay features to estimate the location of the illegal intrusion device. To validate the effectiveness of the proposed method, it has been implemented on a CAN bus prototype, providing empirical evidence of its validity.