Using Ensemble Learning for Anomaly Detection in Cyber–Physical Systems

Abstract

The swift embrace of Industry 4.0 paradigms has led to the growing convergence of Information Technology (IT) networks and Operational Technology (OT) networks. Traditionally isolated on air-gapped and fully trusted networks, OT networks are now becoming more interconnected with IT networks due to the advancement and applications of IoT. This expanded attack surface has led to vulnerabilities in Cyber–Physical Systems (CPSs), resulting in increasingly frequent compromises with substantial economic and life safety repercussions. The existing methods for the anomaly detection of security threats typically use simple threshold-based strategies or apply Machine Learning (ML) algorithms to historical data for the prediction of future anomalies. However, due to the high levels of heterogeneity across different CPS environments, minimizing the opportunities for transfer learning, and the scarcity of real-world data for training, the existing ML-based anomaly detection techniques suffer from a poor predictive performance. This paper introduces a hybrid anomaly detection approach designed to identify threats to CPSs by combining the signature-based anomaly detection typically utilized in IT networks, the threshold-based anomaly detection typically utilized in OT networks, and behavioural-based anomaly detection using Ensemble Learning (EL), which leverages the strengths of multiple ML algorithms against the same dataset to increase the accuracy. Multiple public research datasets were used to validate the proposed approach, with the hybrid methodology employing a divide-and-conquer strategy to offload the detection of certain cyber threats to computationally inexpensive signature-based and threshold-based methods using domain knowledge to minimize the size of the behavioural-based data needed for ML model training, thus achieving a higher accuracy over a reduced timeframe. The experimental results showed accuracy improvements of 4–7% over those of the conventional ML classifiers in performing anomaly detection across multiple datasets, which is particularly important to the operators of CPS environments due to the high financial and life safety costs associated with interruptions to system availability.

Graph Transformer Network Incorporating Sparse Representation for Multivariate Time Series Anomaly Detection

“…Let S = {s (1) , s (2) , • • • , s (T) } ∈ N×T represent a training dataset of multivariate time series with timestamps produced by N sensors. At each time point s (t) ∈ R N , it represents the values of N sensors obtained at time t(t ≤ T).…”

“…This suggests that dimensionality reduction and reconstruction processing for high-dimensional sensor time series data aid in obtaining more meaningful hidden representations of sensor nodes, subsequently enhancing the performance of anomaly detection to a certain extent. (2) Compared to the SGTrans model processed with the Sensor Time Embedding layer, the variant without this layer exhibits slightly inferior performance. This underscores the importance of embedding temporal information in the initial representations of sensor nodes.…”

“…However, the large scale and intricate structures of these MTS data, coupled with their dynamic nature, significantly heighten the risks of cyber-physical attacks. Such threats not only disrupt system operations but also pose severe economic risks and security challenges [2]. Moreover, the increasing interconnectivity and smart automation of industrial systems make them more vulnerable to sophisticated cyber threats, which are becoming more frequent and complex.…”

Two-Phase Industrial Control System Anomaly Detection Using Communication Patterns and Deep Learning

“…In [18], the ICS communication patterns were analyzed, and a detection method based on sequential communication patterns was proposed. In [19], an ensemble method to detect anomaly in CPS was proposed. The model is composed of 5 different supervised learning models, Logistic Regression, Naïve Bayes, SVM (Support Vector Machine), KNN (K-nearest Neighbor), and MLP (Multi-Level Perceptron).…”