Secure Cyber-Physical Data Monitoring Architecture for Real-Time Fault Detection in U.S. Industrial Automation Systems

Abstract

Plant data can be wrong because a sensor or actuator has failed or because someone has changed what the system sees. This article proposes a secure cyber-physical monitoring architecture that treats the data path as zones and conduits, places detectors where their inputs can be trusted, and combines physics-based residuals, statistical monitors and transport-integrity checks with an independently wired second measurement and a watermarked control input. It is tested on a transparent synthetic two-tank pumped process with PI control, eight instruments, five physical faults and five data-integrity or availability attacks with known onsets, comparing five architecture variants over 72 episodes per event. A baseline SCADA with limit alarms detected almost nothing, because closed-loop control holds the reported variables at their setpoints. Model-free statistics caught abrupt events in about 18 s and gradual ones in 12 to 34 minutes. Physics residuals caught leaks, frozen sensors, pump degradation and stiction in 12 to 104 s and a stealthy sensor ramp in about two minutes, but a slow drift only after 17 minutes. Authenticated telemetry with sequence numbers caught a man-in-the-middle change at once and a replay in about 20 s; the independent sensor cut the drift delay to about two minutes; the watermark gave a replay backstop at about 100 s at a cost in actuator activity. False alarms rose from about 2 to about 7 per day across the variants. Sweeps showed where each check fails: a clock offset of 15 s between the two measurement paths made the cross-source check unusable, packet loss turned a naive receiver into a source of false alarms, and a loss of pump gain confounded the watermark test. The data could not separate a drifting transmitter from a stealthy attack on it, which the attribution layer reports as an ambiguous class. All results describe a stylised testbed with three seeds; the roadmap and the mapping to NIST SP 800-82r3, IEC 62443, CISA, NERC CIP and TSA material are proposals and make no compliance claim.