Misbehavior detection of programmable logic controllers through virtual process duplication

Industrial control systems widely rely on Programmable Logic Controllers (PLCs). Concerning security, Intrusion Detection Systems (IDS) are considered an important component, which is becoming more important due to the increased attack surface in progressing digitalization in automated manufacturing. However, adopting IDS in dynamic industrial environments for PLC security is challenging due to the lack of accurate models of correct behavior. We propose a PLC misbehavior detection system that largely mitigates the model problem by leveraging the existence of Digital Twins. By virtually duplicating the implemented logic and intercepting the in- and outgoing traffic, we are able to detect any deviation from correct behavior on the application level. Through a modular approach, our solution can additionally detect several indicators of misbehavior on the network level.