A Review of Anomaly Detection Strategies to Detect Threats to Cyber-Physical Systems

Abstract

Cyber-Physical Systems (CPS) are integrated systems that combine software and physical components. CPS has experienced rapid growth over the past decade in fields as disparate as telemedicine, smart manufacturing, autonomous vehicles, the Internet of Things, industrial control systems, smart power grids, remote laboratory environments, and many more. With the widespread integration of Cyber-Physical Systems (CPS) in various aspects of contemporary society, the frequency of malicious assaults carried out by adversaries has experienced a substantial surge in recent times. Incidents targeting vital civilian infrastructure, such as electrical power grids and oil pipelines, have become alarmingly common due to the expanded connectivity to the public internet, which significantly expands the vulnerability of CPS. This article presents a comprehensive review of existing literature that examines the latest advancements in anomaly detection techniques for identifying security threats in Cyber-Physical Systems. The primary emphasis is placed on addressing life safety concerns within industrial control networks (ICS). A total of 296 papers are reviewed, with common themes and research gaps identified. This paper makes a novel contribution by identifying the key challenges that remain in the field, which include resource constraints, a lack of standardized communication protocols, extreme heterogeneity that hampers industry consensus, and different information security priorities between Operational Technology (OT) and Information Technology (IT) networks. Potential solutions and/or opportunities for further research are identified to address these selected challenges.

Using Ensemble Learning for Anomaly Detection in Cyber–Physical Systems

“…This paper proposes a novel Ensemble Learning-Based Hybrid Anomaly Detection Method comprised of signature-based detection for known threats, threshold-based metrics for the immutable physical characteristics of a CPS, combined with an ensemble-based learning model for behaviour-based anomaly detection, with the goal of improved predictive performance over those of the existing anomaly detection methods, which is demonstrated using two public research datasets (Edge-IIoTset2023 and CICIoT2023). This paper builds upon previous works [14][15][16] by the authors of this paper, furthering the development of a generalizable framework for threat detection in CPS environments that can be applied in a broad variety of CPS environments through the use of EL to overcome weaknesses in existing threat detection models.…”

“…While anomaly detection is a common area of study in ML, there has been limited attention given to threat detection to CPS environments, and less still in the specific area of EL as a strategy for improving accuracy in threat detection to CPSs. Interested readers on this topic may find this review paper [15] worth reading.…”

Securing the IoT Cyber Environment: Enhancing Intrusion Anomaly Detection With Vision Transformers

“…Anomaly detection in multivariate time series data is crucial for various applications, from network intrusion detection in cybersecurity to identifying faulty equipment in industrial settings [31,32,33,34,35]. Unlike univariate time series that analyze a single variable over time, multivariate time series deal with multiple interrelated variables [36,37,38,39,40,41,42], providing a richer picture of the underlying processes [43,44,45,46,47].…”

Towards Improved Threat Mitigation in Digital Environments: A Comprehensive Framework for Cybersecurity Enhancement

“…To mitigate the weaknesses of individual detection methods, many cybersecurity professionals and teams should follow the same path of hybrid method detection that combines several detection techniques. Hybrid systems leverage signature-based, anomaly-based, and behaviour-based detection strengths to enhance robustness and accuracy Jeffrey et al (2023). For instance, a hybrid system might use signatory-based detection systems for known threats, anomalous intrusion systems to uncover peculiar traffic patterns and user activity-monitoring intrusion systems.…”