Multi-level Anomaly Detection in Industrial Control Systems via Package Signatures and LSTM Networks

Abstract

We outline an anomaly detection method for industrial control systems (ICS) that combines the analysis of network package contents that are transacted between ICS nodes and their time-series structure. Specifically, we take advantage of the predictable and regular nature of communication patterns that exist between so-called field devices in ICS networks. By observing a system for a period of time without the presence of anomalies we develop a base-line signature database for general packages. A Bloom filter is used to store the signature database which is then used for package content level anomaly detection. Furthermore, we approach time-series anomaly detection by proposing a stacked Long Short Term Memory (LSTM) networkbased softmax classifier which learns to predict the most likely package signatures that are likely to occur given previously seen package traffic. Finally, by the inspection of a real dataset created from a gas pipeline SCADA system, we show that an anomaly detection scheme combining both approaches can achieve higher performance compared to various current stateof-the-art techniques.

Security in Process: Visually Supported Triage Analysis in Industrial Process Data

“…Anomalies in the data are detected with a plethora of different approaches. Schneider et al use autoencoders to detect anomalies in cyber-physical system networks [25], Goh et al and Feng et al use neural networks for the detection [12,14]. One class support vector machines are presented by Maglaras et al as a machine learning algorithm to detect novel and unknown attacks [21].…”

Industrial Control System Defence: Debugging ICS Maintenance Network Traffic

“…Alves et al goes on to propose and develop an architecture with ML embedded as an Intrusion Prevention System (IPS) on a PLC. Feng et al (2017) applies a type of Recurrent Neural Network (RNN) called Long Short-Term Memory (LSTM) to ICS traffic using Modbus, to learn packet sequences of ICS traffic and provide an intrusion detection system (IDS). LSTM incorporates inter-packet dependency, therefore provides a temporal context, and the network traffic is between controllers and devices (e.g., actuators and sensors), rather than solely PLC programming request messages.…”

“…This raises the possibility that the maintainer might trigger activity which has adverse effects; it is desirable to mitigate this risk through monitoring and alerts. There have been a number of efforts to identify anomalous activity using machine learning of network traffic, for example Dada et al (2017), Feng et al (2017) and Wang et al (2017). This approach has been applied primarily to common and open protocols, often for intrusion detection, but the authors believe it is equally applicable to proprietary and niche industrial protocols such as used in ICS, and for another purpose: maintenance supervision.…”

A New Anomaly Detection System for School Electricity Consumption Data

“…Veracini et al [11] presented an anomaly detection strategy for hyperspectral imagery based on a fully unsupervised Gaussian mixture learning. Feng et al [12] outlined an anomaly detection method for industrial control systems that combines the analysis of network package contents and their time-series structure. Kumar [13] applied parallel and distributed anomaly detection algorithms to detect sophisticated cyberattacks on large-scale networks.…”