A non-intrusive state monitoring framework for embedded devices in industrial control systems is provided in this standard. The techniques covered include analog signal acquisition, analog data processing, model training, anomaly detection, and human-machine interface. The analog signal acquisition is to gather various types of sensor signals from the embedded devices. The analog data processing is to process the collected data to extract features. The model training is to train a classification model that can identify different types of attacks. The anomaly detection is to implement, manage, and secure the detection engine. The human-machine interface is to provide alarm information and get feedback.

This standard defines a system framework of a non-intrusive state monitoring system. This standard specifies the functional modules of the non-intrusive state monitoring system, which includes analog and digital data collecting module, analog and digital data processing module, model training module, anomaly detection module and human-machine-interface module. Specifically, this standard also describes definitions, terminologies, module interfaces, and technical requirements of each module.

The purpose of this standard is to provide a framework for non-intrusive state monitoring systems to ensure the security of embedded devices in ICS. The standard specifies the system design, functional modules and their interfaces, performance indicators of the non-intrusive state monitoring system, thus coordinate stakeholders could jointly complete the system.