The advancement of Industrial Internet-of-Things (IIoT) magnifies the cyber risk of automated production lines, especially to deception attacks that tamper with the monitoring data to prevent the manipulated operation of production lines from being detected. To address this issue, we propose Stochastic Manufacturing (StoM), a new paradigm of manufacturing that is resistant to deception by design. StoM voids the foundation of deception attacks — i.e., the highly predictable operation data due to the cyclical manufacturing process — by injecting controlled stochasticity into the operation of production lines without degrading manufacturing efficiency or quality. StoM then examines if this stochasticity can be observed from the operation data and triggers an alarm of deception attack if not. We have experimentally evaluated StoM on two production line platforms, showing StoM to detect deception attacks with a detection rate exceeding 99.1%, a false alarm rate below 0.1%, and a latency of less than 1.2 manufacturing cycles. Our empirical analysis also shows that it is highly impractical for attackers to spoof the controlled stochasticity.

Industrial robots are prototypical cyber-physical systems widely deployed in (smart) manufacturing, which operate according to the operation code uploaded by the human operator and are monitored in real-time based on their movement data. However, industrial robots suffer from replay attacks, via which attackers can manipulate the robot operation without being observed by the monitoring system. To mitigate this vulnerability, we design a novel intrusion detection system for industrial robots using their power fingerprint, calledPIDS(Power-basedIntrusionDetectionSystem), and deliverPIDSas abump-in-the-wiremodule installed at the powerline of commodity robots. The foundation ofPIDSis the physically-induced dependency between the robot movement and the concomitant power consumption, whichPIDScaptures via joint physical analysis and (cyber) data-driven modeling.PIDSthen fingerprints the robot movements observed by the monitoring system using their expected power consumption, and cross-validates the fingerprints with empirically collected power information — a mismatch thereof flags anomalies of the observed movements (i.e., evidence of replay attack). We have evaluatedPIDSusing three models of robots from different vendors — i.e., ABB IRB120, KUKA KR6 R700, and Universal Robots UR5 robots — with over 2,000 operation cycles. Experimental results show thatPIDSdetects replay attacks at an average rate of 96.5 percent (up to 99.9 percent) and a 0.1s latency.

Industrial robots have been shown to suffer from replay attacks, via which adversaries not only manipulate the robot operation by downloading malicious code, but also prevent the detection of this manipulation by replaying recorded (and normal) movement data to the monitoring system. To protect industrial robots from replay attacks, we design a novel intrusion detection system using the power fingerprint of robots, called PIDS (Power-based Intrusion Detection System), and deliver PIDS as a bump-in-the-wire module installed at the powerline of commodity robots. The foundation of PIDS is the physically-induced dependency between the robot movement and the concomitant electrical power consumption, which PIDS captures via joint physical analysis and (cyber) data-driven modeling. PIDS then fingerprints the robot movements observed by the monitoring system using their expected power consumption, and cross-validates the fingerprints with empirically collected power information --- a mismatch thereof flags anomalies of the observed movements (i.e., evidence of replay attack). We have evaluated PIDS using three models of robots from different vendors --- i.e., ABB IRB120, KUKA KR6 R700, and Universal Robots UR5 robots --- with over 2, 000 operation cycles. The experimental results show that PIDS detects replay attacks with an average rate of 96.5% (up to 99.9%) and a 0.1s latency.