WaveSleuth: Retrospective PLC Memory for Anomaly Detection in Industrial Control Systems

This paper presents WaveSleuth for industrial control systems (ICS), a novel intrusion detection system (IDS) that leverages the volatile memory of controller devices, transforming it into audio signals to detect cyberattacks. Attackers target programmable logic controllers (PLCs) in ICS to sabotage underlying physical processes; their attack footprints are often present in PLC memory, which WaveSleuth utilizes to detect a compromised PLC. Since PLCs are proprietary and heterogeneous, analyzing their device memory at a semantic level is challenging and does not scale. WaveSleuth models a PLC device memory as lossless audio signals at the byte level and deploys audio fingerprinting to detect anomalies with high confidence without requiring semantic knowledge of the data structures and firmware in the memory. Specifically, it periodically extracts volatile memory from a PLC device, converts the acquired raw memory data into audio signals, and then extracts a set of features called Mel-frequency cepstral coefficients (MFCCs) to measure the dynamic time warping (DTW) distance between two consecutive memory snapshots. WaveSleuth uses a distance threshold to determine whether the most recently acquired memory snapshot has been altered unexpectedly. We evaluate WaveSleuth on four real-world control logic and device firmware attacks on an actual PLC used in industrial settings to control a laboratory-scale, fully functional four-floor elevator. We also benchmark WaveSleuth with a state-of-the-art solution, PEM, which requires semantic knowledge to analyze PLC memory contents. Our evaluation results show that the attacks modify different PLC memory regions, such as firmware jump table and I/O data; WaveSleuth outperforms PEM and detects all attacks successfully.