Passive Localization for Silent Intrusion Device in Fieldbus Network Based on Reflection-Based Group Fingerprint

With the rapid development of industrial control systems (ICSs), fieldbus networks are widely adopted for their simplicity and cost-effectiveness, but their weak security makes them vulnerable to physical intrusion attacks. Attackers can connect external devices to eavesdrop on bus traffic and subsequently launch attacks. To locate silent intrusion devices engaged in eavesdropping, existing methods actively transmit pulse signals to measure reflection signals from intrusion devices, but this can disrupt normal communication and cause unintended device operations. To address this issue, we parallel an auxiliary resistor at the bus end and collect the reference reflection signals generated by this resistor on the normal communication signals transmitted by benign devices at each node to construct a group fingerprint. By comparing the reflection signals from the silent intrusion device with the reference in the group fingerprint, we can passively and accurately determine the location of the intrusion device. Furthermore, we develop an automatic dual-end acquisition tool to measure signals from both bus ends, reducing localization errors. The effectiveness of our method is validated on real-world CAN, Modbus, and Profibus testbeds. Extensive experiments across different scenarios demonstrate that our method can robustly locate silent intrusion devices with a region localization error of only 5 cm and a point localization error of <30 cm at a sampling rate of 50 MS/s.