PIL-MDRS: Physical Intrusion Localization Based on Multidevice Reflection Signals in ICS

In industrial control systems, terminal devices in fieldbus networks are vulnerable to physical intrusion attacks, where attackers can directly install external intrusion devices. Currently, the localization capabilities of existing methods for intrusion devices are limited. As the reflection signals in transmitted signals are imperceptible and difficult to extract, many methods focus on actively transmitting pulse signals to locate intrusion devices. In this article, we enhance the reflection signals in transmitted signals by parallel connection of an appropriate resistor with the gateway and propose a localization method based on the collaboration of multiple devices' reflection signals. This method can significantly improve localization precision while reducing the sampling rate and does not occupy communication bandwidth. Experimental results on a real-world controller area network testbed demonstrate that our method can achieve a localization precision of 5 cm when locating intrusion devices under a sampling rate of 50 MS/s.