Fingerprinting Movements of Industrial Robots for Replay Attack Detection

Industrial robots are prototypical cyber-physical systems widely deployed in (smart) manufacturing, which operate according to the operation code uploaded by the human operator and are monitored in real-time based on their movement data. However, industrial robots suffer from replay attacks, via which attackers can manipulate the robot operation without being observed by the monitoring system. To mitigate this vulnerability, we design a novel intrusion detection system for industrial robots using their power fingerprint, called PIDS (Power-based Intrusion Detection System), and deliver PIDS as a bump-in-the-wire module installed at the powerline of commodity robots. The foundation of PIDS is the physically-induced dependency between the robot movement and the concomitant power consumption, which PIDS captures via joint physical analysis and (cyber) data-driven modeling. PIDS then fingerprints the robot movements observed by the monitoring system using their expected power consumption, and cross-validates the fingerprints with empirically collected power information - a mismatch thereof flags anomalies of the observed movements (i.e., evidence of replay attack). We have evaluated PIDS using three models of robots from different vendors - i.e., ABB IRB120, KUKA KR6 R700, and Universal Robots UR5 robots - with over 2,000 operation cycles. Experimental results show that PIDS detects replay attacks at an average rate of 96.5 percent (up to 99.9 percent) and a 0.1s latency.