Detecting Attackers with State Estimation
Stefan Stephenson-Moe presents physics-based state estimation techniques to detect Stuxnet-like sensor spoofing and false data injection in industrial controllers.
Summary
The Threat of Sensor Spoofing in Sophisticated OT Malware
Advanced industrial malware (like Stuxnet) manipulates physical processes while forging normal sensor telemetry to keep human operators unaware of impending equipment damage.
Principles of Physics-Based State Estimation
Stefan Stephenson-Moe explains how mathematical state estimation models calculate expected physical system behaviors based on physical laws (such as thermodynamics and fluid dynamics).
Detecting False Data Injection Attacks
By comparing real-time sensor measurements against estimated physical states, anomaly detection algorithms identify discrepancies caused by manipulated sensor packets.
Implementing State Estimation on Modern PLCs
The author demonstrates practical implementations running on edge controllers, providing a resilient layer of physical process verification.
Related talks
ICS Village·55 min
Jamil Jaffer · Ernie Bio · David Etue · Jennifer DeTrani
Cybersecurity leaders analyze the Colonial Pipeline and JBS ransomware attacks, debating mandatory reporting and defensive resilience for critical infrastructure.
ICS Village·46 min
Sara Fluchs · Vivek Ponnada
Sara Fluchs and Vivek Ponnada introduce the community-driven Top 20 Secure PLC Coding Practices, bringing secure engineering directly into ladder logic.


