Detecting anomalous behavior of PLC using semi-supervised machine learning

Yau, Ken; Chow, Kam-Pui; Yiu, Siu-Ming; Chan, Chun-Fai

doi:10.1109/cns.2017.8228713

Cited by 22 publications

(14 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The F-measure is the weighted average of precision and recall. F-measure is more useful than accuracy, although, it happens in unbalanced class distributions only [29]. The results show that Random Forest achieves 75% of accuracy with the smallest dataset and 91% when the data and attributes increased.…”

Section: Resultsmentioning

confidence: 97%

A supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system

Robles-Durazno

Moradpoor

McWhinnie

et al. 2018

2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

View full text Add to dashboard Cite

Industrial Control Systems are part of our daily life in industries such as transportation, water, gas, oil, smart cities, and telecommunications. Technological development over time have improved their components including operating system platforms, hardware capabilities, and connectivity with networks inside and outside the organization. Consequently, the Industrial Control Systems components are exposed to sophisticated threats with weak security mechanism in place. This paper proposes a supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system. A testbed of such a system is implemented using the Festo MPA Control Process Rig. The machine-learning algorithms, which include SVN, KNN, and Random Forest, perform classification tasks process in three different datasets obtained from the testbed. The algorithms are compared in terms of accuracy and F-measure. The results show that Random Forest achieves 5% better performance over KNN and SVM with small datasets and 4% regarding large datasets. For the time taken to build the model, KNN presents the best performance. However, its difference with Random Forest is smaller than with SVM.

show abstract

Section: Resultsmentioning

confidence: 97%

A supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system

Robles-Durazno

Moradpoor

McWhinnie

et al. 2018

2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

View full text Add to dashboard Cite

show abstract

“…This automated judgment also has some problems with false alarm rates. Yau et al [16] proposed using semisupervised machine learning to detect anomalous PLC behavior based on captured PLC memory address values. Halas et al [17] proposed using encryption algorithms to encrypt data on PLCs to achieve the goal of data integrity.…”

Section: Related Workmentioning

confidence: 99%

PLC Protection System Based on Verification Separation

Xiao-jun¹,

Li²,

Li³

et al. 2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

Supervisory control and data acquisition systems (SCADAs) play an important role in supervising and controlling industrial production with the help of programmable logic controllers (PLCs) in industrial control systems (ICSs). A PLC receives the control information or program from a SCADA to control the production equipment and feeds the production data back to the SCADA. Once a SCADA is controlled by an attacker, it may threaten the safety of industrial production. The lack of security protection, such as identity authentication and encryption for industrial control protocols, increases the potential security risks. In this paper, we propose a PLC protection system combined with a monitor between a SCADA and a PLC and a physically separated monitoring station. By using the PLC protection system, identity verification and command verification are separated, and both the identity of the operator and the corresponding commands are recorded. Experiments show that even if the SCADA is controlled by an attacker, our system could still protect the PLC in the field and record the identity of the key command operator, which facilitates the tracing and forensics of malicious activities.

show abstract

“…Junejo et al [15] use unsupervised ML algorithms to create a behaviour-based defense for a water treatment facility testbed with PLCs. In their paper Yau et al [45] employ a semi-supervised One-class Support Vector Machine ML algorithm to detect anomalous PLC events and aid forensics investigations. Meleshko et al [27] propose a method for detecting anomalous sensor data in cyberphysical systems and apply it on an example of a water supply system.…”

Section: Applications and Related Workmentioning

confidence: 99%

ICSML: Industrial Control Systems Machine Learning Inference Framework natively executing on IEC 61131-3 compliant devices

Constantine¹,

Rajput²,

Maniatakos³

2022

Preprint

View full text Add to dashboard Cite

Industrial Control Systems (ICS) have played a catalytic role in enabling the 4th Industrial Revolution. ICS devices like Programmable Logic Controllers (PLCs), automate, monitor and control critical processes in industrial, energy and commercial environments. The convergence of traditional Operational Technology (OT) with Information Technology (IT) has opened a new and unique threat landscape. This has inspired defense research that focuses heavily on Machine Learning (ML) based anomaly detection methods that run on external IT hardware which means an increase in costs and the further expansion of the threat landscape. To remove this requirement, we introduce the ICS Machine Learning inference framework (ICSML) which enables the execution of ML models natively on the PLC. ICSML is implemented in IEC 61131-3 code and works around the limitations imposed by the domain-specific languages, providing a complete set of components for the creation of fully fledged ML models in a way similar to established ML frameworks. We then demonstrate a complete endto-end methodology for creating ICS ML models using an external framework for training and ICSML for the PLC implementation. To evaluate our contributions we run a series of benchmarks studying memory and performance and compare our solution to the TFLite inference framework. Finally, to demonstrate the abilities of IC-SML and to verify its non-intrusive nature, we develop and evaluate a case study of a real defense for process aware attacks against a Multi Stage Flash (MSF) desalination plant.

show abstract

Detecting anomalous behavior of PLC using semi-supervised machine learning

Cited by 22 publications

References 6 publications

A supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system

A supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system

PLC Protection System Based on Verification Separation

ICSML: Industrial Control Systems Machine Learning Inference Framework natively executing on IEC 61131-3 compliant devices

Contact Info

Product

Resources

About