Skip to content

Detecting Attackers with State Estimation

Stefan Stephenson-Moe

Stefan Stephenson-Moe presents physics-based state estimation techniques to detect Stuxnet-like sensor spoofing and false data injection in industrial controllers.

Summary

The Threat of Sensor Spoofing in Sophisticated OT Malware

Advanced industrial malware (like Stuxnet) manipulates physical processes while forging normal sensor telemetry to keep human operators unaware of impending equipment damage.

Principles of Physics-Based State Estimation

Stefan Stephenson-Moe explains how mathematical state estimation models calculate expected physical system behaviors based on physical laws (such as thermodynamics and fluid dynamics).

Detecting False Data Injection Attacks

By comparing real-time sensor measurements against estimated physical states, anomaly detection algorithms identify discrepancies caused by manipulated sensor packets.

Implementing State Estimation on Modern PLCs

The author demonstrates practical implementations running on edge controllers, providing a resilient layer of physical process verification.

Related talks

ICS Village·55 min

  • DEF CON
  • ICS / OT
  • Date: Aug 2021
  • Location: Las Vegas

Jamil Jaffer · Ernie Bio · David Etue · Jennifer DeTrani

Cybersecurity leaders analyze the Colonial Pipeline and JBS ransomware attacks, debating mandatory reporting and defensive resilience for critical infrastructure.

ransomwarecritical-infrastructurepipeline-security+2

ICS Village·46 min

  • DEF CON
  • ICS / OT
  • Date: Aug 2021
  • Location: Las Vegas

Sara Fluchs · Vivek Ponnada

Sara Fluchs and Vivek Ponnada introduce the community-driven Top 20 Secure PLC Coding Practices, bringing secure engineering directly into ladder logic.

plcsecure-codingladder-logic+2