Detecting stealthy attacks against industrial control systems based on residual skewness analysis

Abstract

With the integration of the modern industrial control systems (ICS) with the Internet technology, ICS can make full use of the rich resources on the Internet to facilitate remote process control. However, every coin has two sides. More exposure to the outside IT world has made ICS an attractive target for hackers, so it becomes urgent to protect the security of ICS. Skilled attackers can penetrate control networks and then manipulate sensor readings or control signals persistently until the system crashes, while still keeping themselves undetected by following the expected behavior of the system closely. This kind of attacks are referred to as stealthy attacks. As far as we know, many existing intrusion detection techniques only investigate the magnitudes of behavior residuals, so they cannot detect this kind of stealthy attacks. In this paper, we discover that residuals generated during stealthy attacks exhibit significant skewness compared to attack-free residuals. Based on the new observation, we propose an effective and fast technique to detect stealthy attacks against ICS based on residual skewness analysis. Skewness coefficients can distinguish the counterfeited residuals from the attack-free residuals effectively. A larger absolute value of the skewness coefficient generally indicates the occurrence of a more intense stealthy attack. Finally, we conduct comprehensive experiments to verify the effectiveness and efficiency of the proposed stealthy attack detection approach.

A brief review on attack design and detection strategies for networked cyber-physical systems

“… failure detector to detect replay attack, while (Hu et al 2019). proposed a residual based detection approach by using skewness analysis of the residual signal.…”

“…Numerical experiments were carried out by using IEEE 9, 14, 30, 118, and 300-bus systems to verify the proposed defense framework. (Hu et al 2019) focused on detection of stealthy attacks on CPSs. They proposed a residual based detection approach by using skewness analysis of the residual signal.…”

Destructive Attacks Detection and Response System for Physical Devices in Cyber-Physical Systems

“…A majority of these works propose a method to CPSs attack detection using double closed-loop security control structure [12] or design an anomaly detection approach based on zone partition for the Industrial CPSs [13]. Hu et al [14], propose a detection technique against stealthy attacks that can keep themselves undetected by following the expected behaviour of the system closely. Some consider a coding method for the sensor outputs to detect stealthy false data injection attacks [15].…”

A control‐switching approach for cyberattack detection in process systems with minimal false alarms

“…[15][16][17] An important part of the cyberattack resiliency of PCSs is the ability to detect the presence of a cyberattack, and many detection schemes have been proposed. [15][16][17][18][19][20][21][22][23][24][25][26] Attack detection schemes may be broadly classified as either passive or active. Passive detection schemes monitor a process using regular operational data.…”