A Dataset to Support Research in the Design of Secure Water Treatment Systems

Yun

Lecture Notes in Computer Science

2020

This study proposes an anomaly detection method for operational data of industrial control systems (ICSs). Sequence-to-sequence neural networks were applied to train and predict ICS operational data and interpret their time-series characteristic. The proposed method requires only a normal dataset to understand ICS's normal state and detect outliers. This method was evaluated with SWaT (secure water treatment) dataset, and 29 out of 36 attacks were detected. The reported method also detects the attack points, and 25 out of 53 points were detected. This study provides a detailed analysis of false positives and false negatives of the experimental results.

“…Attack 35 According to [6], attack 35 occurred at process 1, but herein, the attack was detected at process 3. Before the attack, P-101 was open, and P-202 was close.…”

Section: Attack 19mentioning

confidence: 98%

Anomaly Detection for Industrial Control Systems Using Sequence-to-Sequence Neural Networks

Yun

Lecture Notes in Computer Science

2020

2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE)

“…For SWaT and WADI, time series datasets are already available online [29], and were obtained by running the testbeds non-stop for seven (resp. 14) days without any interruption from attacks or faults.…”

Section: A Step One: Learning a Prediction Modelmentioning

confidence: 99%

“…We found that smart fuzzing could automatically identify suites of attacks that drove these CPSs into 27 different unsafe states involving water flow, pressure, tank levels, and consumer supply. Furthermore, it covered six unsafe states beyond those in an established expert-crafted benchmark [29]. Finally, we evaluated the utility of smart fuzzing for testing attack defence mechanisms by launching it with SWaT's invariant-based monitoring system enabled [24], [34].…”

Section: Introductionmentioning

confidence: 99%

Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences

Chen

Poskitt

Sun

et al. 2019

Self Cite

The threat of attack faced by cyber-physical systems (CPSs), especially when they play a critical role in automating public infrastructure, has motivated research into a wide variety of attack defence mechanisms. Assessing their effectiveness is challenging, however, as realistic sets of attacks to test them against are not always available. In this paper, we propose smart fuzzing, an automated, machine learning guided technique for systematically finding 'test suites' of CPS network attacks, without requiring any knowledge of the system's control programs or physical processes. Our approach uses predictive machine learning models and metaheuristic search algorithms to guide the fuzzing of actuators so as to drive the CPS into different unsafe physical states. We demonstrate the efficacy of smart fuzzing by implementing it for two real-world CPS testbeds-a water purification plant and a water distribution system-finding attacks that drive them into 27 different unsafe states involving water flow, pressure, and tank levels, including six that were not covered by an established attack benchmark. Finally, we use our approach to test the effectiveness of an invariant-based defence system for the water treatment plant, finding two attacks that were not detected by its physical invariant checks, highlighting a potential weakness that could be exploited in certain conditions.

Proceedings of the 14th International Conference on Availability, Reliability and Security

“…The process has been monitored for a total of eleven days, where seven days were ran as normal operation, while the four last days contained attacks. The data set used in this work is provided by iTrust, Centre for Research in Cyber Security, Singapore University of Technology and Design and is titled Secure Water Treatment (SWaT ) [21,26]. It consists of pcap-files containing the packets of the OT network traffic as well as csv-lists containing the sensor and actuator values at each time point.…”

Section: Data Setmentioning

confidence: 99%

Using Temporal and Topological Features for Intrusion Detection in Operational Networks

Antón¹,

Fraunholz²,

Schotten³

2019

Until two decades ago, industrial networks were deemed secure due to physical separation from public networks. An abundance of successful attacks proved that assumption wrong. Intrusion detection solutions for industrial application need to meet certain requirements that differ from home-and office-environments, such as working without feedback to the process and compatibility with legacy systems. Industrial systems are commonly used for several decades, updates are often difficult and expensive. Furthermore, most industrial protocols do not have inherent authentication or encryption mechanisms, allowing for easy lateral movement of an intruder once the perimeter is breached. In this work, an algorithm for motif discovery in time series, Matrix Profiles, is used to detect outliers in the timing behaviour of an industrial process. This process was monitored in an experimental environment, containing ground truth labels after attacks were performed. Furthermore, the graph representations of a different industrial data set that has been emulated are used to detect malicious activities. These activities can be derived from anomalous communication patterns, represented as edges in the graph. Finally, an integration concept for both methods is proposed.• Security and privacy → Intrusion detection systems; Network security; • Theory of computation → Design and analysis of algorithms; • Applied computing → Enterprise architectures.