Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning

Abstract

In this paper, we propose and evaluate the application of unsupervised machine learning to anomaly detection for a Cyber-Physical System (CPS). We compare two methods: Deep Neural Networks (DNN) adapted to time series data generated by a CPS, and one-class Support Vector Machines (SVM). These methods are evaluated against data from the Secure Water Treatment (SWaT) testbed, a scaled-down but fully operational raw water purification plant. For both methods, we first train detectors using a log generated by SWaT operating under normal conditions. Then, we evaluate the performance of both methods using a log generated by SWaT operating under 36 different attack scenarios. We find that our DNN generates fewer false positives than our one-class SVM while our SVM detects slightly more anomalies. Overall, our DNN has a slightly better F measure than our SVM. We discuss the characteristics of the DNN and one-class SVM used in this experiment, and compare the advantages and disadvantages of the two methods.

Detecting Cyber Attacks in Industrial Control Systems Using Convolutional Neural Networks

“…Precision Recall F1 DNN [11] 0.983 0.678 0.803 SVM [11] 0.925 0.699 0.796 TABOR [12] 0.862 0.788 0.823 1D CNN [13] 0 features are linear, and PCA can capture them. As PCA has an analytic solution that does not require iterative optimization, its training is much faster then the discussed neural networks (see Table V).…”

Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences

“…Other approaches learn models from physical data logs, and use them to evaluate whether or not the current state represents normal behaviour or not: most (e.g. [7], [12], [39]) use unsupervised learning to construct these models, although Chen et al [23], [25] use supervised learning by automatically seeding faults in the control programs (of a high-fidelity simulator). Adepu and Mathur [21], [22], [24] systematically and manually derive a comprehensive set of physics-based invariants and other conditions that relate the states of actuators and sensors, with any violations of them during operation reported.…”

“…Let v s denote the current value of sensor s, L s denote its lower safety threshold, H s denote its upper safety threshold, and r s = H s − L s denote its range of safe values. Let Select k parents from P using Roulette Wheel Selection; 5 Generate new candidates from parents using crossover; 6 Generate new candidates from parents using bit flip mutation with probability pm; 7 Compute fitness of new candidates c with f (M (S, c)); 8 Replace P with the n fittest of the new and old candidates; 9 until timeout; 10 return candidate c ∈ P that maximises f (M (S, c));…”

“…Given the potential to cause massive disruption, such systems have become prime targets for cyber attackers, with a number of successful cases reported in recent years [3], [4]. This pervasive threat faced by CPSs has motivated research and development into a wide variety of attack defence mechanisms, including techniques based on anomaly detection [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], fingerprinting [16], [17], [18], [19], and monitoring conditions or physical invariants [20], [21], [22], [23], [24], [25], [26], [27]. The practical utility of these different countermeasures ultimately depends on how effective they are at their principal goal: detecting and/or preventing attacks.…”

Learning from Mutants: Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System

“…Apart from monitoring physical invariants, the SWaT testbed has also been used to evaluate other attack detection mechanisms, such as a hierarchical intrusion detection system for monitoring network traffic [38], and anomaly detection approaches based on unsupervised machine learning [5,6]. The latter approaches were trained and evaluated using an attack log [12] from the testbed itself.…”