Toward Improving the Security of IoT and CPS Devices: An AI Approach

Abstract

Detecting anomalously behaving devices in security-and-safety-critical applications is an important challenge. This paper presents an off-device methodology for detecting the anomalous behavior of devices considering their power consumption data. The methodology takes advantage of the fact that every action on-board a device will be reflected in its power trace. This argument makes it inevitable for anomalously behaving device to go undetected. We transform the device’s 1-D instantaneous power consumption signals to 2-D time-frequency images using Constant Q Transformation (CQT). The CQT images capture valuable information about the tasks performed on-board a device. By applying Histograms of Oriented Gradients (HOG) on the CQT images, we extract robust features that preserve the edges of time-frequency structures and capture the directionality of the edge information. Consequently, we transform the anomaly detection problem into an image classification problem. We train a Convolutional Neural Network on the HOG images to classify the power signals to detect anomaly. We validated the methodology using a wide spectrum of emulated malware scenarios, five real malware applications from the well-known Drebin dataset, DDOS attacks, cryptomining malware, and faulty CPU cores. Across 18 datasets, our methodology demonstrated detection performance of ∼ 88% accuracy and 85% F-Score, resulting in improvements of 9% - 17% over other methods using power signals.

A Systematic Analysis of Enhancing Cyber Security Using Deep Learning for Cyber Physical Systems

“…• Adversarial Robustness: CPS are often targeted by sophisticated cyber-attackers who use techniques such as adversarial machine learning to evade detection. There is a need for DL models that are robust to these attacks and that can continue to operate effectively even in the presence of adversarial inputs [114].…”

Photovoltaic inverter anomaly detection method based on LSTM serial depth autoencoder

“…Although the existing literature has developed the existing anomaly detection methods, most of them are limited to the characteristics of the device for anomaly detection, and cannot take into account the characteristics of other non-self-faults of the equipment, such as the failure to consider the data security problems caused by these data in the transmission process. In the selection of data, previous researchers have mainly focused on the power consumption of the equipment [15], the distance phase of the device [16] and other characteristics of these devices to detect anomalies. In this paper, six multi-dimensional features of photovoltaic grid-connected inverters are collected to construct anomaly detection models, which are power consumption, three voltage values of three-phase voltage, communication data length, and communication data delay.…”