A Spatial-Temporal Features Based Fingerprinting Method for Machine tools in DNC Networks
Zhongfeng Jin, Nan Li, Chao Liu, Meimei Li, Shaohua An, Weiqing Huang · 2020
As the most widely used solution for intelligent manufacturing, the Distributed Numerical Control (DNC) system faces with various novel attack opportunities caused by increasing connection to industrial ethernet and external interfaces. Attackers can easily fabricate packets between machine tools and Machine Data Collection (MDC) server. This may threaten not only processing tasks and production logic but also physical safety and business efficiency. Intrusion Detection System (IDS) is seen as a promising solution to these problems. However, existing device identifier used by IDS (e.g. IP and MAC) can be forged easily. In order to address this problem, we propose a fingerprinting method (Spatial-Temporal Feature Fingerprint, STFF) enabling identification of machine tools. The fingerprint is a vector composed of spatial and temporal features extracted from payload grayscale image, which is constructed with all payloads in a polling period. Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) network are used to extract spatial and temporal features from payload grayscale image respectively. Finally, a real-world unencrypted data set with two vendors (three models for each) of machine tools is used to verify the performance of the fingerprinting method. Our evaluation experiments show that the STFF could be a unique identifier to describe the communication relationship between machine tools and MDC server.