Sensor and Process Fingerprinting in Industrial Control Systems

## Overview and Context

In this talk, Martina Ochoa presents research conducted jointly with Najib Chaudhary on sensor and process fingerprinting in Industrial Control Systems (ICS). The work stems from academic research at a Singapore university where Ochoa supervised Chaudhary's PhD thesis, combining Ochoa's background in mathematics and systems engineering with Chaudhary's background in electrical engineering.

The presentation highlights the critical nature of ICS and operational technology, emphasizing that water treatment and distribution infrastructure are vulnerable to catastrophic impact. A cited historical precedent is the Maroochy Shire incident in Australia, where a disgruntled insider compromised a water management system and discharged raw sewage into local waterways and hotel grounds. The primary premise of the research is counterintuitive: while engineering and IT disciplines typically aim to eliminate measurement noise, physical sensor noise can be leveraged as an inherent security mechanism to detect sensor spoofing and tampering.

---

## Experimental Testbed: The SWaT Facility

The empirical research and attack demonstrations were conducted on the **Secure Water Treatment (SWaT)** testbed located at the Singapore University of Technology and Design (SUTD). Built with support from the Singapore government and operational since 2015, SWaT is an open-data, production-grade testbed designed for cybersecurity research.

* **Physical Architecture:** The testbed mirrors a full-scale industrial facility, featuring six sequential stages including chemical treatment, ultraviolet (UV) treatment, and filtration. It cleans raw water to produce potable drinking water and contains primary operational storage tanks (such as a 2,000-liter water tank). * **Network Segments:** SWaT implements defense-in-depth network layering behind firewalls: * **Level 0 (L0) Network:** Connects physical field instrumentation (analog sensors and actuators) to Remote I/O modules and Programmable Logic Controllers (PLCs). * **Level 1 (L1) Network:** Connects PLCs to one another to share plant process data. * **Supervisory / SCADA Level:** Human-Machine Interfaces (HMIs) and operator control rooms.

The researchers focused experiments on a water storage tank, noting that tank overflow or drying out pumps causes severe physical damage while avoiding the safety hazards associated with tampering with chemical tanks.

---

## Attack Models and Sensor Spoofing

The authors define a dual physical and cyber threat model that exploits the historical absence of authentication across low-level industrial networks:

* **Physical Attack Vectors:** Attackers may physically swap sensor wiring, plug in rogue replacement sensors, or inject false voltages/signals directly into the analog cables linking sensors to analog-to-digital converters (e.g., Remote I/O). * **Cyber / Man-in-the-Middle (MitM) Vectors:** Attackers compromised at the L0, L1, or SCADA network layers can intercept and forge industrial network packets. * **Attack Execution ("Shameless" Spoofing):** * Because PLCs implicitly trust reported sensor values, an attacker can falsify water level readings to induce detrimental control actions. For example, falsely reporting high water levels forces the PLC to halt inflows and activate outflow pumps, running the pump dry and damaging equipment. * In an active testbed demonstration, an attacker conducted an ongoing MitM spoofing attack while an inflow valve was opened. The attacker clamped the transmitted sensor reading at 628 mm, presenting a frozen "virtual reality" to both the PLC logic and the human operator. While the physical tank water rose by roughly 10 cm, the system registered no change until the attack ceased, causing the reading to instantly jump from 628 mm to 732 mm.

---

## Defense Approaches and Limitations

The talk analyzes existing countermeasures and their practical constraints in industrial settings:

* **Cryptographic Authentication:** While standard in traditional IT, cryptography faces major hurdles in ICS: * Legacy embedded devices frequently possess constrained computational resources, making heavy cryptographic verification difficult under high-frequency packet sampling requirements. * Industrial protocols lack native authentication fields, requiring non-standard protocol encapsulation. * Cryptography cannot protect the analog transmission segment between raw physical sensors and digital conversion nodes. * Cryptographic approaches fail against insider threats, compromised supply chains, or firmware updates where keys are extracted and used to sign forged data. * **Physics- and Model-Based Anomaly Detection:** Researchers often employ physical process models to predict upcoming states based on past measurements and known actuator positions. While effective at flagging abrupt, physically impossible variations (such as the sudden jump in the "shameless" spoofing scenario), this technique requires creating and maintaining accurate mathematical models of the physical environment.