Challenges in Machine Learning based approaches for Real-Time Anomaly Detection in Industrial Control Systems

Ahmed, Chuadhry Mujeeb; R, Gauthama Raman M; Mathur, Aditya P.

doi:10.1145/3384941.3409588

Cited by 37 publications

(22 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [23], multilayer perception (MLP) and support vector machine (SVM) were used to predict the measurement parameters and to identify and classify the outliers in WDS. In [24] also, supervised and unsupervised detection models were developed to identify anomalies in water treatment plants. Nonetheless, these last two studies were focused on training the DNN model based on the water quality parameters, and hydraulic features of the system were not contemplated.…”

Section: Introductionmentioning

confidence: 99%

“…Nonetheless, these last two studies were focused on training the DNN model based on the water quality parameters, and hydraulic features of the system were not contemplated. As such, the proposed models in [23,24] cannot detect any cyberattacks targeting the hydraulic-related readings of a WDS, such as the tank's level measurements. Despite significant efforts by previous studies in the application of deep learning and artificial intelligence on detection of different forms of cyberattacks in water systems, there are considerable limitations yet to be addressed to improve the performance and efficacy of the DNN-based cyberattack detection models.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Detection of Random False Data Injection Cyberattacks in Smart Water Systems Using Optimized Deep Neural Networks

Moazeni

Khazaei

2022

Energies

View full text Add to dashboard Cite

A cyberattack detection model based on supervised deep neural network is proposed to identify random false data injection (FDI) on the tank’s level measurements of a water distribution system. The architecture of the neural network, as well as various hyper-parameters, is modified and tuned to acquire the highest detection performance using the smallest size of training data set. The efficacy of the proposed detection model against various activation functions including sigmoid, rectified linear unit, and softmax is examined. Regularization and momentum techniques are applied to update the weights and prohibit overfitting. Moreover, statistical metrics are presented to evaluate the performance and effectiveness of the proposed model in the presence of a range of measurement noise levels. The proposed model is tested for three attack scenarios composed for the battle of the attack detection algorithms. Results confirm that the size of the data sets required to train the neural network (NN) to accomplish the highest levels of accuracy and precision is significantly decreased as the number of hidden layers is increased. The trained 4- and 5-layer deep neural networks are able to detect the readings’ FDIs with 100% precision and accuracy in the presence of 30% background noise in the sensory data.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Detection of Random False Data Injection Cyberattacks in Smart Water Systems Using Optimized Deep Neural Networks

Moazeni

Khazaei

2022

Energies

View full text Add to dashboard Cite

show abstract

“…However, the same networks simultaneously expose the system to malicious actors. Securing CPS is challenging and different from the pure IT systems in different ways [2], [3]. Recently there is a lot of attention being paid to develop defense technologies for CI.…”

Section: Introductionmentioning

confidence: 99%

Curse of System Complexity and Virtue of Operational Invariants: Machine Learning based System Modeling and Attack Detection in CPS

Shahid

Ahmed

Palleti

et al. 2022

2022 IEEE Conference on Dependable and Secure Computing (DSC)

View full text Add to dashboard Cite

Cyber Physical Systems (CPS) security has gained a lot of interest in recent years. Different approaches have been proposed to tackle the security challenges. Intrusion detection has been of most interest so far, involving design-based and data-based approaches. Design-based approaches require domain expertise and are not scalable, on the other hand, data-based approaches suffer from the lack of real-world datasets available for specific critical physical processes. In this work, a data collection effort is made on a realistic Water Distribution (WADI) test-bed. Collected data consists of both the normal operation as well as a range of attack scenarios. Next, machine learning-based system-modeling techniques are considered using the data from WADI. It is shown that the accuracy of system model-based intrusion detectors depends on the model accuracy and for nonlinear processes, it is non-trivial to obtain accurate system models. Moreover, an operational invariants-based attack detection technique is proposed using the system design parameters. It is shown that using a simple rule-based anomaly detector performs better than the complex black-box data-based techniques.

show abstract

“…For these reasons, it is necessary to have new intrusion detection schemes for ICS networks of both the process control and network communication levels. For this purpose, the use of machine learning algorithms seems to be appropriate at present [19][20][21][22][23]. However, there is a problem with available datasets suitable for learning, training, and testing.…”

Section: Introductionmentioning

confidence: 99%

Application Perspective on Cybersecurity Testbed for Industrial Control Systems

Pospíšil

Blažek

Kuchař

et al. 2021

Sensors

View full text Add to dashboard Cite

In recent years, the Industry 4.0 paradigm has accelerated the digitalization process of the industry, and it slowly diminishes the line between information technologies (IT) and operational technologies (OT). Among the advantages, this brings up the convergence issue between IT and OT, especially in the cybersecurity-related topics, including new attack vectors, threats, security imperfections, and much more. This cause raised new topics for methods focused on protecting the industrial infrastructure, including monitoring and detection systems, which should help overcome these new challenges. However, those methods require high quality and a large number of datasets with different conditions to adapt to the specific systems effectively. Unfortunately, revealing field factory setups and infrastructure would be costly and challenging due to the privacy and sensitivity causes. From the lack of data emerges the new topic of industrial testbeds, including sub-real physical laboratory environments, virtual factories, honeynets, honeypots, and other areas, which helps to deliver sufficient datasets for mentioned research and development. This paper summarizes related works in the area of industrial testbeds. Moreover, it describes best practices and lessons learned for assembling physical, simulated, virtual, and hybrid testbeds. Additionally, a comparison of the essential parameters of those testbeds is presented. Finally, the findings and provided information reveal research and development challenges, which must be surpassed.

show abstract

Challenges in Machine Learning based approaches for Real-Time Anomaly Detection in Industrial Control Systems

Cited by 37 publications

References 26 publications

Detection of Random False Data Injection Cyberattacks in Smart Water Systems Using Optimized Deep Neural Networks

Detection of Random False Data Injection Cyberattacks in Smart Water Systems Using Optimized Deep Neural Networks

Curse of System Complexity and Virtue of Operational Invariants: Machine Learning based System Modeling and Attack Detection in CPS

Application Perspective on Cybersecurity Testbed for Industrial Control Systems

Contact Info

Product

Resources

About