Physical Intrusion Detection via Signal Reflection in Fieldbus Network

As the underlying network of wind energy con-version systems (WECS), fieldbus networks are typically pro-tected from cyber attacks through network isolation. However, attackers can bypass the isolation mechanism and physically connect malicious devices to networks to launch various attacks. Existing methods mainly focus on obtaining abnormal signals from intrusion devices to detect intrusion devices. However, these methods cannot detect inactive intrusion devices which only eavesdrop without sending any signals. In this paper, we discover signal differences caused by reflection signals and propose a physical intrusion detection method based on reflection signal extraction. By extracting the voltage characteristics of the rising and falling edges of normal transmission signals and constructing fingerprints, our method can effectively detect inactive intrusion devices. The experimental results on a real CAN testbed show that the F -score for detecting inactive intrusion devices can reach 95.2 % in various attack scenarios.