Applying methods of machine learning in the task of intrusion detection based on the analysis of industrial process state and ICS networking

Abstract

Modern industrial control systems (ICS) are increasingly becoming targets of cyber attacks. Traditional security tools based on a signature approach are not always able to detect a new attack, the signature of which has not yet been described. In particular, this occurs during targeted attacks on industrial facilities. Cyber attacks can cause anomalies in the operation of an industrial control system and process equipment under its control. Therefore, to detect attacks, it is advisable to use an approach based on the detection of anomalies. A reasonable way to implement this approach is to use machine learning techniques. The paper deals with the most common methods of machine learning (decision tree algorithms, linear algorithms, support vector machine) and neural networks. To assess their applicability in the problem of detection of ICS anomalies, the Additional Tennessee Eastman Process Simulation Data for Anomaly Detection Evaluation and Gas Pipeline datasets were used.

Artificial Intelligence in Process Engineering

“…Fault/anomaly detection: Sokolov et al [ 29 ] investigated the use of ML to detect process anomalies of sensor readings and controller settings as an indicator for targeted cyberattacks in industrial plants. One example featured a chemical reaction plant consisting of a reactor, a condenser, a vapor–liquid separator, a compressor, and a stripper using the “Tennessee Eastman process simulation data for anomaly detection evaluation.” Dataset with eight chemical components (A–H) were involved, along with the target components being G and H, shown in Figure .…”

“…One example featured a chemical reaction plant consisting of a reactor, a condenser, a vapor–liquid separator, a compressor, and a stripper using the “Tennessee Eastman process simulation data for anomaly detection evaluation.” Dataset with eight chemical components (A–H) were involved, along with the target components being G and H, shown in Figure . [ 29 ]…”

“…Reproduced under the terms of the CC BY 4.0 licence. [ 29 ] Copyright 2019, Faculty of Mechanical Engineering, Belgrade University.…”

“…To further increase the accuracy and robustness the authors suggested to break down the process into subprocesses to decrease the complexity of the problem for the ML system, an approach closely related to hybrid models as described in Section 6. [ 29 ] As an additional example Xing‐yu et al [ 30 ] trained a fault recognition network for a grinding system with a 30‐dimensional input feature data set consisting out of 1000 sets of feature vectors (864 of fault free and 135 sets of faulty data) while using and comparing a standard Back propagation network (BPN), a combined AE‐Softmax network and an RNN‐LSTM network (see Section 6), with the later one showing the most accurate performance. Thirty‐dimensional data for the input parameters were used and compressed (see Section 6) to 24‐dimensional data, the normal state together with 8 types of failure were chosen as output parameters.…”

The detection of sensor signal attacks in industrial control systems

“…Autoregression modeling and control limits techniques deployed for PLC security monitoring in [11], also belong to the data-centric group. A comparison of the performances of linear classification methods (Logistic Regression, Lasso, Support Vectors based classification with linear kernel), decision trees, and fully connected neural networks in cyber attacks detection in networked industrial control systems is presented in [12]. The analysis has shown that among the considered techniques fully connected neural networks presented the best accuracy (around 80%).…”