Anomaly Detection in Cyber Physical Systems Using Recurrent Neural Networks

Goh, Jonathan; Adepu, Sridhar; Tan, Marcus; Lee, Zi Shan

doi:10.1109/hase.2017.36

Cited by 281 publications

(189 citation statements)

References 7 publications

Supporting

Mentioning

187

Contrasting

Unclassified

Order By: Relevance

“…Some of them used supervised learning [8], [9] and achieved high precision results, however the supervised learning approach is limited to the modeled attacks only. To overcome this obstacle, a number of other studies used unsupervised deep neural networks (DNNs) for detecting anomalies and attacks in ICS data [10]- [12]. Kravchik and Shabtai [13] suggested using unsupervised neural networks based on 1D CNNs and demonstrated the detection of 31 out of 36 cyber attacks in the popular SWaT dataset [14], improving upon previously published results.…”

Section: Introductionmentioning

confidence: 83%

Detecting Cyber Attacks in Industrial Control Systems Using Convolutional Neural Networks

Kravchik

Shabtai

2018

Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy

224

167

View full text Add to dashboard Cite

Industrial control systems (ICSs) are widely used and vital to industry and society. Their failure can have severe impact on both economics and human life. Hence, these systems have become an attractive target for attacks, both physical and cyber. A number of attack detection methods have been proposed, however they are characterized by a low detection rate, a substantial false positive rate, or are system specific. In this paper, we study an attack detection method based on simple and lightweight neural networks, namely, 1D convolutions and autoencoders. We apply these networks to both the time and frequency domains of the collected data and discuss pros and cons of each approach. We evaluate the suggested method on three popular public datasets and achieve detection rates matching or exceeding previously published detection results, while featuring small footprint, short training and detection times, and generality. We also demonstrate the effectiveness of PCA, which, given proper data preprocessing and feature selection, can provide high attack detection scores in many settings. Finally, we study the proposed method's robustness against adversarial attacks, that exploit inherent blind spots of neural networks to evade detection while achieving their intended physical effect. Our results show that the proposed method is robust to such evasion attacks: in order to evade detection, the attacker is forced to sacrifice the desired physical impact on the system. This finding suggests that neural networks trained under the constraints of the laws of physics can be trusted more than networks trained under more flexible conditions.

show abstract

Section: Introductionmentioning

confidence: 83%

Detecting Cyber Attacks in Industrial Control Systems Using Convolutional Neural Networks

Kravchik

Shabtai

2018

Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy

224

167

View full text Add to dashboard Cite

show abstract

“…The SWaT testbed and its dataset [12] have been used to evaluate a number of other approaches for cyber-attack prevention, including learning classifiers from data [14], [19], monitoring network traffic [20], or monitoring process invariants [21], [22]. These process invariants are derived from the physical laws concerning different aspects of the SWaT system, and thus in our terminology can be considered in the category of rule-based anomaly detection methods.…”

Section: Related Workmentioning

confidence: 99%

Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning

Inoue

Yamagata

Chen³

et al. 2017

2017 IEEE International Conference on Data Mining Workshops (ICDMW)

218

148

View full text Add to dashboard Cite

In this paper, we propose and evaluate the application of unsupervised machine learning to anomaly detection for a Cyber-Physical System (CPS). We compare two methods: Deep Neural Networks (DNN) adapted to time series data generated by a CPS, and one-class Support Vector Machines (SVM). These methods are evaluated against data from the Secure Water Treatment (SWaT) testbed, a scaled-down but fully operational raw water purification plant. For both methods, we first train detectors using a log generated by SWaT operating under normal conditions. Then, we evaluate the performance of both methods using a log generated by SWaT operating under 36 different attack scenarios. We find that our DNN generates fewer false positives than our one-class SVM while our SVM detects slightly more anomalies. Overall, our DNN has a slightly better F measure than our SVM. We discuss the characteristics of the DNN and one-class SVM used in this experiment, and compare the advantages and disadvantages of the two methods.

show abstract

“…Anomalies in the data are detected with a plethora of different approaches. Schneider et al use autoencoders to detect anomalies in cyber-physical system networks [25], Goh et al and Feng et al use neural networks for the detection [12,14]. One class support vector machines are presented by Maglaras et al as a machine learning algorithm to detect novel and unknown attacks [21].…”

Section: Anomaly Detection In Time Seriesmentioning

confidence: 99%

Security in Process: Visually Supported Triage Analysis in Industrial Process Data

Lohfink

Antón

Schotten

et al. 2020

IEEE Trans. Visual. Comput. Graphics

View full text Add to dashboard Cite

Fig. 1. Overview of our visualization system: To support triage analysis in OT-networks, our visualization combines sensor readings with results from an anomaly detection algorithm. Spiral plots encode readings and detection results in color and line thickness respectively. An overview of the complete time frame is provided in a time slider and anomalies are highlighted.Abstract-Operation technology networks, i.e. hard-and software used for monitoring and controlling physical/industrial processes, have been considered immune to cyber attacks for a long time. A recent increase of attacks in these networks proves this assumption wrong. Several technical constraints lead to approaches to detect attacks on industrial processes using available sensor data. This setting differs fundamentally from anomaly detection in IT-network traffic and requires new visualization approaches adapted to the common periodical behavior in OT-network data. We present a tailored visualization system that utilizes inherent features of measurements from industrial processes to full capacity to provide insight into the data and support triage analysis by laymen and experts. The novel combination of spiral plots with results from anomaly detection was implemented in an interactive system. The capabilities of our system are demonstrated using sensor and actuator data from a real-world water treatment process with introduced attacks. Exemplary analysis strategies are presented. Finally, we evaluate effectiveness and usability of our system and perform an expert evaluation.

show abstract

Anomaly Detection in Cyber Physical Systems Using Recurrent Neural Networks

Cited by 281 publications

References 7 publications

Detecting Cyber Attacks in Industrial Control Systems Using Convolutional Neural Networks

Detecting Cyber Attacks in Industrial Control Systems Using Convolutional Neural Networks

Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning

Security in Process: Visually Supported Triage Analysis in Industrial Process Data

Contact Info

Product

Resources

About