Detecting Control Injection Attacks Using Energy Data Anomalies in Computer Numerical Control Machining

Jeffrey Kimmell; Vladimir Orlyanchik; Logan Sturm; Joel Dawson; Curtis Taylor

doi:10.1007/978-3-031-81888-2_3

Detecting Control Injection Attacks Using Energy Data Anomalies in Computer Numerical Control Machining

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

The widespread adoption of networked devices, sophisticated automation and data-driven processes in industry – also known as Industry 4.0 – has boosted the quantity and quality of manufacturing products. However, the benefits come with substantial increases in the attack surfaces of manufacturing processes and systems. In addition to affecting the quality and readiness of critical products, attacks against manufacturing processes and systems can have severe physical consequences, including human injury and death. This chapter presents the results of remote network-based control injection attacks on a computer numerical control mill. The focus is on the impacts of attacks during computer numerical control mill operation. A machine-agnostic, affordable and scalable solution for attack monitoring is developed by considering the physical effects of the attacks on wax workpieces. A simple threshold-based method for detecting attacks is demonstrated and its effectiveness is evaluated.

Original language	English
Title of host publication	Critical Infrastructure Protection XVIII - 18th IFIP WG 11.10 International Conference, ICCIP 2024, Proceedings
Editors	Jason Staggs, Sujeet Shenoi
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	43-63
Number of pages	21
ISBN (Print)	9783031818875
DOIs	https://doi.org/10.1007/978-3-031-81888-2_3
State	Published - 2025
Event	18th IFIP WG 11.10 International Conference on Critical Infrastructure Protection, ICCIP 2024 - Arlington, United States Duration: Mar 18 2024 → Mar 19 2024

Publication series

Name	IFIP Advances in Information and Communication Technology
Volume	725 IFIPAICT
ISSN (Print)	1868-4238
ISSN (Electronic)	1868-422X

Conference

Conference	18th IFIP WG 11.10 International Conference on Critical Infrastructure Protection, ICCIP 2024
Country/Territory	United States
City	Arlington
Period	03/18/24 → 03/19/24

Funding

This material is based on work supported by the U.S. Department of Energy Office of Energy Efficiency and Renewable Energy (EERE) under the Advanced Materials and Manufacturing Technologies Office (AMMTO) Award no. DE-EE0009046.

Keywords

Attack Detection
Attack Quantification
Manufacturing Cyber Security
Power Analysis

Access to Document

10.1007/978-3-031-81888-2_3

Cite this

Kimmell, J., Orlyanchik, V., Sturm, L., Dawson, J., & Taylor, C. (2025). Detecting Control Injection Attacks Using Energy Data Anomalies in Computer Numerical Control Machining. In J. Staggs, & S. Shenoi (Eds.), Critical Infrastructure Protection XVIII - 18th IFIP WG 11.10 International Conference, ICCIP 2024, Proceedings (pp. 43-63). (IFIP Advances in Information and Communication Technology; Vol. 725 IFIPAICT). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-3-031-81888-2_3

Kimmell, Jeffrey ; Orlyanchik, Vladimir ; Sturm, Logan et al. / Detecting Control Injection Attacks Using Energy Data Anomalies in Computer Numerical Control Machining. Critical Infrastructure Protection XVIII - 18th IFIP WG 11.10 International Conference, ICCIP 2024, Proceedings. editor / Jason Staggs ; Sujeet Shenoi. Springer Science and Business Media Deutschland GmbH, 2025. pp. 43-63 (IFIP Advances in Information and Communication Technology).

@inproceedings{d7db40b66bee4b939ecf2da514f5d6a8,

title = "Detecting Control Injection Attacks Using Energy Data Anomalies in Computer Numerical Control Machining",

abstract = "The widespread adoption of networked devices, sophisticated automation and data-driven processes in industry – also known as Industry 4.0 – has boosted the quantity and quality of manufacturing products. However, the benefits come with substantial increases in the attack surfaces of manufacturing processes and systems. In addition to affecting the quality and readiness of critical products, attacks against manufacturing processes and systems can have severe physical consequences, including human injury and death. This chapter presents the results of remote network-based control injection attacks on a computer numerical control mill. The focus is on the impacts of attacks during computer numerical control mill operation. A machine-agnostic, affordable and scalable solution for attack monitoring is developed by considering the physical effects of the attacks on wax workpieces. A simple threshold-based method for detecting attacks is demonstrated and its effectiveness is evaluated.",

keywords = "Attack Detection, Attack Quantification, Manufacturing Cyber Security, Power Analysis",

author = "Jeffrey Kimmell and Vladimir Orlyanchik and Logan Sturm and Joel Dawson and Curtis Taylor",

note = "Publisher Copyright: {\textcopyright} IFIP International Federation for Information Processing 2025.; 18th IFIP WG 11.10 International Conference on Critical Infrastructure Protection, ICCIP 2024 ; Conference date: 18-03-2024 Through 19-03-2024",

year = "2025",

doi = "10.1007/978-3-031-81888-2\_3",

language = "English",

isbn = "9783031818875",

series = "IFIP Advances in Information and Communication Technology",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "43--63",

editor = "Jason Staggs and Sujeet Shenoi",

booktitle = "Critical Infrastructure Protection XVIII - 18th IFIP WG 11.10 International Conference, ICCIP 2024, Proceedings",

}

Kimmell, J, Orlyanchik, V , Sturm, L , Dawson, J & Taylor, C 2025, Detecting Control Injection Attacks Using Energy Data Anomalies in Computer Numerical Control Machining. in J Staggs & S Shenoi (eds), Critical Infrastructure Protection XVIII - 18th IFIP WG 11.10 International Conference, ICCIP 2024, Proceedings. IFIP Advances in Information and Communication Technology, vol. 725 IFIPAICT, Springer Science and Business Media Deutschland GmbH, pp. 43-63, 18th IFIP WG 11.10 International Conference on Critical Infrastructure Protection, ICCIP 2024, Arlington, United States, 03/18/24. https://doi.org/10.1007/978-3-031-81888-2_3

Detecting Control Injection Attacks Using Energy Data Anomalies in Computer Numerical Control Machining. / Kimmell, Jeffrey; Orlyanchik, Vladimir ; Sturm, Logan et al.
Critical Infrastructure Protection XVIII - 18th IFIP WG 11.10 International Conference, ICCIP 2024, Proceedings. ed. / Jason Staggs; Sujeet Shenoi. Springer Science and Business Media Deutschland GmbH, 2025. p. 43-63 (IFIP Advances in Information and Communication Technology; Vol. 725 IFIPAICT).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Detecting Control Injection Attacks Using Energy Data Anomalies in Computer Numerical Control Machining

AU - Kimmell, Jeffrey

AU - Orlyanchik, Vladimir

AU - Sturm, Logan

AU - Dawson, Joel

AU - Taylor, Curtis

N1 - Publisher Copyright: © IFIP International Federation for Information Processing 2025.

PY - 2025

Y1 - 2025

N2 - The widespread adoption of networked devices, sophisticated automation and data-driven processes in industry – also known as Industry 4.0 – has boosted the quantity and quality of manufacturing products. However, the benefits come with substantial increases in the attack surfaces of manufacturing processes and systems. In addition to affecting the quality and readiness of critical products, attacks against manufacturing processes and systems can have severe physical consequences, including human injury and death. This chapter presents the results of remote network-based control injection attacks on a computer numerical control mill. The focus is on the impacts of attacks during computer numerical control mill operation. A machine-agnostic, affordable and scalable solution for attack monitoring is developed by considering the physical effects of the attacks on wax workpieces. A simple threshold-based method for detecting attacks is demonstrated and its effectiveness is evaluated.

AB - The widespread adoption of networked devices, sophisticated automation and data-driven processes in industry – also known as Industry 4.0 – has boosted the quantity and quality of manufacturing products. However, the benefits come with substantial increases in the attack surfaces of manufacturing processes and systems. In addition to affecting the quality and readiness of critical products, attacks against manufacturing processes and systems can have severe physical consequences, including human injury and death. This chapter presents the results of remote network-based control injection attacks on a computer numerical control mill. The focus is on the impacts of attacks during computer numerical control mill operation. A machine-agnostic, affordable and scalable solution for attack monitoring is developed by considering the physical effects of the attacks on wax workpieces. A simple threshold-based method for detecting attacks is demonstrated and its effectiveness is evaluated.

KW - Attack Detection

KW - Attack Quantification

KW - Manufacturing Cyber Security

KW - Power Analysis

UR - https://www.scopus.com/pages/publications/105000380949

U2 - 10.1007/978-3-031-81888-2_3

DO - 10.1007/978-3-031-81888-2_3

M3 - Conference contribution

AN - SCOPUS:105000380949

SN - 9783031818875

T3 - IFIP Advances in Information and Communication Technology

SP - 43

EP - 63

BT - Critical Infrastructure Protection XVIII - 18th IFIP WG 11.10 International Conference, ICCIP 2024, Proceedings

A2 - Staggs, Jason

A2 - Shenoi, Sujeet

PB - Springer Science and Business Media Deutschland GmbH

T2 - 18th IFIP WG 11.10 International Conference on Critical Infrastructure Protection, ICCIP 2024

Y2 - 18 March 2024 through 19 March 2024

ER -

Kimmell J, Orlyanchik V , Sturm L , Dawson J , Taylor C. Detecting Control Injection Attacks Using Energy Data Anomalies in Computer Numerical Control Machining. In Staggs J, Shenoi S, editors, Critical Infrastructure Protection XVIII - 18th IFIP WG 11.10 International Conference, ICCIP 2024, Proceedings. Springer Science and Business Media Deutschland GmbH. 2025. p. 43-63. (IFIP Advances in Information and Communication Technology). doi: 10.1007/978-3-031-81888-2_3