CNN based method for the development of cyber-attacks detection algorithms in industrial control systems

Nedeljković, Dušan; Jakovljević, Živana

doi:10.1016/j.cose.2021.102585

Cited by 43 publications

(17 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Surprisingly, the optimized MLP architecture achieved the highest performance on the SWaT testbed in terms of F1 score. Recently, Nedeljkovic and Jakovljevic in [ 14 ] developed a method that consisted of several one-step forecasting univariate 1D-CNN models that are trained with attack-free data. Unlike our approach, only sensor signals are used, and the hyperparameters of the CNN architectures are individually optimized with a grid-based strategy for each signal separately.…”

Section: Related Workmentioning

confidence: 99%

“…Based on the evaluation in [ 44 ], none of the stealthy attacks (Attacks 3, 16, 41) in the level-sensory signals were detected by TABOR. Our causal-based approach, such as the CNN-based approach [ 14 ], not only detected these attacks via both univariate and multivariate models, but their sensory signals signified the component (level sensor) that was indeed under attack. The dual isolation-forest-based (DIF) framework, as is presented in [ 38 ], was capable of detecting stealthy Attacks 16 and 41, while Attack 3 was missed.…”

Section: Case Studymentioning

confidence: 99%

“…The specific attack may trigger potential damage in the process of reverse osmosis. IDS-CNN [ 14 ] performed similarly to 1D CNN; however, the method did not recognize Attack 24, in which water quality in SWaT was compromised. Remarkably, our approach identifies all previous attacks that were missed by the alternative methods.…”

Section: Case Studymentioning

confidence: 99%

“…Univariate models [ 14 , 15 ] can partly alleviate the curse of dimensionality issue since autoregression forecasting models can be generated individually from each transmitted signal within an ICS. Their implementation is relatively easy, and they can be locally deployed directly in control system devices so that latency issues are avoided.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A Causality-Inspired Approach for Anomaly Detection in a Water Treatment Testbed

Koutroulis

Mutlu

Kern

2022

Sensors

View full text Add to dashboard Cite

Critical infrastructure, such as water treatment facilities, largely relies on the effective functioning of industrial control systems (ICSs). Due to the wide adoption of high-speed network and digital infrastructure technologies, these systems are now highly interconnected not only to corporate networks but also to the public Internet, mostly for remote control and monitoring purposes. Sophisticated cyber-attacks may take advantage the increased interconnectedness or other security gaps of an ICS and infiltrate the system with devastating consequences to the economy, national security, and even human life. Due to the paramount importance of detecting and isolating these attacks, we propose an unsupervised anomaly detection approach that employs causal inference to construct a robust anomaly score in two phases. First, minimal domain knowledge via causal models helps identify critical interdependencies in the system, while univariate models contribute to individually learn the normal behavior of the system’s components. In the final phase, we employ the extreme studentized deviate (ESD) on the computed score to detect attacks and to exclude any irrelevant sensor signals. Our approach is validated on the widely used Secure Water Treatment (SWaT) benchmark, and it exhibits the highest F1 score with zero false alarms, which is extremely important for real-world deployment.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Case Studymentioning

confidence: 99%

Section: Case Studymentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Causality-Inspired Approach for Anomaly Detection in a Water Treatment Testbed

Koutroulis

Mutlu

Kern

2022

Sensors

View full text Add to dashboard Cite

show abstract

“…Neural networks (NN) exhibit impressive performance and are now being assisted in many different areas such as medical diagnosis, computer vision, autonomous driving, and cyber attack detection. In particular, these technologies have been introduced to monitor and detect possible incoming cyber attacks that target Industrial Control Systems (ICS), a subset of cyber-physical systems (CPS) [11,12,14,28,29,34,53,52,55,56,18,23,25,40]. Defending these systems is extremely important, since ICSs are central to many areas of industry, energy production, and critical infrastructure, and they are exposed to external threats as they need to be remotely accessible by operators.…”

Section: Introductionmentioning

confidence: 99%