Behaviour-Based Attack Detection and Classification in Cyber Physical Systems Using Machine Learning

Junejo, Khurum Nazir; Goh, Jonathan

doi:10.1145/2899015.2899016

Cited by 77 publications

(53 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The PMU or synchro-phasor was built upon the cyber layer to serve real-time information [25] which can act as a bridge among physical and cyber amplitudes [26]. Besides, machine learning approaches have also been performed to intrusion detection related issues; following studies can be found in references [27][28][29][30]. Authors of the paper [27] presented a machine learning behavior-based method for the intrusion detection, and the data set that they utilized was Secure Water Treatment (SWaT)-generated information from eighteen attacks with ten type models.…”

Section: A Backgroundmentioning

confidence: 99%

“…Besides, machine learning approaches have also been performed to intrusion detection related issues; following studies can be found in references [27][28][29][30]. Authors of the paper [27] presented a machine learning behavior-based method for the intrusion detection, and the data set that they utilized was Secure Water Treatment (SWaT)-generated information from eighteen attacks with ten type models. In paper [28] authors utilized a rapid one-class category method that overcomes the disadvantages of high sensitivity to the outliers; also, the presented approach was examined on an actual data set from distribution systems of drink water in France.…”

Section: A Backgroundmentioning

confidence: 99%

See 1 more Smart Citation

False Data Injection Attack Detection based on Hilbert-Huang Transform in AC Smart Islands

et al. 2020

View full text Add to dashboard Cite

In Smart Island (SI) systems, the operators of power distribution system usually utilize actual-time measurement information as the Advanced Metering Infrastructure (AMI) to have accurate, efficient, advanced control and monitoring. SI system can be vulnerable to complicated information integrity attacks such as False Data Injection Attack (FDIA) on some equipment including sensors and controllers, which can generate misleading operational decision in the system. Today, lack of detailed research in the evaluation of power system that links the FDIAs with system stability is felt, and it will be important for both assessment of the effect of cyber-attack and taking preventive protection measures. In this regards, time-frequency-based differential approach is proposed for SI cyber-attack detection according to non-stationary signal assessment. In this paper, non-stationary signal processing approach of Hilbert-Huang Transform (HHT) is performed for the FDIA detection in several case studies. Since various critical case studies with a small FDIA in data where accurate and efficient detection can be a challenge, the simulation results confirm the efficiency of HHT approach. In this research, the configuration of the SI test case is developed in the MATLAB software with several Distributed Generations (DGs). As a result, it is found that the HHT approach is completely efficient and reliable for FDIA detection target in AC-SI. The simulation results verify that the proposed model is able to achieve accuracy rate of 93.17%.

show abstract

Section: A Backgroundmentioning

confidence: 99%

Section: A Backgroundmentioning

confidence: 99%

False Data Injection Attack Detection based on Hilbert-Huang Transform in AC Smart Islands

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Particularly, the anomaly detection algorithm outlined in Reference used a long short‐term memory (LSTM) neural network as a predictor to model normal behavior of a water treatment testbed, and used the Cumulative Sum (CUSUM) method to identify anomalies. Using various machine‐learning classification methods, cyber‐attacks on power systems were distinguished from process disturbances in Reference , and a behavior‐based intrusion detection algorithm was developed to identify the type of attack . Similarly, detection of cyber‐attacks in a chemical process was realized via development of feed‐forward artificial neural networks in Reference , where compromised signals were rerouted to a secure sensor upon detection.…”

Section: Introductionmentioning

confidence: 99%

“…Using various machine-learning classification methods, cyber-attacks on power systems were distinguished from process disturbances in Reference 17, and a behavior-based intrusion detection algorithm was developed to identify the type of attack. 18 Similarly, detection of cyber-attacks in a chemical process was realized via development of feed-forward artificial neural networks in Reference 19, where compromised signals were rerouted to a secure sensor upon detection. These recent literature contributions have demonstrated the feasibility of machine-learning algorithms in anomaly detection.…”

Section: Introductionmentioning

confidence: 99%

A cyber‐secure control‐detector architecture for nonlinear processes

Chen

Christofides

2020

AIChE Journal

View full text Add to dashboard Cite

This work presents a detector‐integrated two‐tier control architecture capable of identifying the presence of various types of cyber‐attacks, and ensuring closed‐loop system stability upon detection of the cyber‐attacks. Working with a general class of nonlinear systems, an upper‐tier Lyapunov‐based Model Predictive Controller (LMPC), using networked sensor measurements to improve closed‐loop performance, is coupled with lower‐tier cyber‐secure explicit feedback controllers to drive a nonlinear multivariable process to its steady state. Although the networked sensor measurements may be vulnerable to cyber‐attacks, the two‐tier control architecture ensures that the process will stay immune to destabilizing malicious cyber‐attacks. Data‐based attack detectors are developed using sensor measurements via machine‐learning methods, namely artificial neural networks (ANN), under nominal and noisy operating conditions, and applied online to a simulated reactor‐reactor‐separator process. Simulation results demonstrate the effectiveness of these detection algorithms in detecting and distinguishing between multiple classes of intelligent cyber‐attacks. Upon successful detection of cyber‐attacks, the two‐tier control architecture allows convenient reconfiguration of the control system to stabilize the process to its operating steady state.

show abstract

“…In the last decade, the use of machine learning has grown from the field of statistics to become a primary mechanism for prediction in diverse applications. In particular, machine learning methods have been widely used in sensors, such as addressing energy-aware communications [ 5 ], attack detection and classification [ 6 ], task scheduling in wireless sensor networks [ 7 ] and generating workloads for cloud computing [ 8 ]. Due to the energy and bandwidth constraints of sensors, it is not possible to transmit all the data back to the base station for processing and inference, therefore, it is necessary to apply distributed machine learning in sensors, which can greatly reduce the amount of data in the communication and truly utilize the distributed characteristics of sensors [ 9 ].…”

Section: Introductionmentioning

confidence: 99%

A Parameter Communication Optimization Strategy for Distributed Machine Learning in Sensors

Zhang

Ren

et al. 2017

Sensors

View full text Add to dashboard Cite

In order to utilize the distributed characteristic of sensors, distributed machine learning has become the mainstream approach, but the different computing capability of sensors and network delays greatly influence the accuracy and the convergence rate of the machine learning model. Our paper describes a reasonable parameter communication optimization strategy to balance the training overhead and the communication overhead. We extend the fault tolerance of iterative-convergent machine learning algorithms and propose the Dynamic Finite Fault Tolerance (DFFT). Based on the DFFT, we implement a parameter communication optimization strategy for distributed machine learning, named Dynamic Synchronous Parallel Strategy (DSP), which uses the performance monitoring model to dynamically adjust the parameter synchronization strategy between worker nodes and the Parameter Server (PS). This strategy makes full use of the computing power of each sensor, ensures the accuracy of the machine learning model, and avoids the situation that the model training is disturbed by any tasks unrelated to the sensors.

show abstract

Behaviour-Based Attack Detection and Classification in Cyber Physical Systems Using Machine Learning

Cited by 77 publications

References 19 publications

False Data Injection Attack Detection based on Hilbert-Huang Transform in AC Smart Islands

False Data Injection Attack Detection based on Hilbert-Huang Transform in AC Smart Islands

A cyber‐secure control‐detector architecture for nonlinear processes

A Parameter Communication Optimization Strategy for Distributed Machine Learning in Sensors

Contact Info

Product

Resources

About