A Reflection-based Channel-State Group Fingerprint to Detect Intrusion Devices in ICS

As the underlying network of the industrial control system (ICS), the fieldbus network can prevent attacks from the network. However, attackers can bypass physical defenses and physically connect intrusion devices to the fieldbus network to carry out various attacks. Many existing methods focus on detecting active intrusion devices by extracting their signal characteristics, but they struggle to detect inactive intrusion devices that are performing eavesdropping attacks without sending signals. This paper proposes a reflection-based channel-state group fingerprint to detect inactive intrusion devices. We theoretically analyze the reflection signals generated by the access of the intrusion device and observe that these reflection signals impact the signals of benign devices. Based on this, we extract the signal from a benign device before the intrusion and utilize it as a channel-state fingerprint. We detect inactive intrusion devices by analyzing the channel-state differences before and after intrusion. Additionally, we combine the channel-state fingerprints of multiple groups of devices to improve detection performance. The experimental results show that our method outperforms 99% in all detection metrics when detecting inactive intrusion devices.