The ICS² products are designed for industrial processes. What differentiates industrial processes from other systems needing cyber protection? There are two key differences.
The first difference is that industrial process plants contain a large number of built-in sensors, which measure physical quantities such as flow, pressure and temperature. These sensors have definable behavior and joint behavior, which can be followed by a cyber security system to detect deviation from the normal behavior of the plant.
The second difference is that industrial processes have feedback control loops that relate very closely to the measured sensors. Every control action taken (such as changing a valve state) results in a cascade of physical activity which can again be measured and matched to the control activity.
These key features are shared in various degrees by almost all industrial processes. water systems, oil and gas plants, petrochemical plants and power generation plants. Designing a cyber security system that uses the particular features of such plants gives a huge advantage to the cyber defender. The attacker wishing to hide its attack will need to fake the intricate behavior of the plant, which is learned by the ICS² system.