CNN based method for the development of cyber-attacks detection algorithms in industrial control systems

A Causality-Inspired Approach for Anomaly Detection in a Water Treatment Testbed

“…Surprisingly, the optimized MLP architecture achieved the highest performance on the SWaT testbed in terms of F1 score. Recently, Nedeljkovic and Jakovljevic in [ 14 ] developed a method that consisted of several one-step forecasting univariate 1D-CNN models that are trained with attack-free data. Unlike our approach, only sensor signals are used, and the hyperparameters of the CNN architectures are individually optimized with a grid-based strategy for each signal separately.…”

“…Based on the evaluation in [ 44 ], none of the stealthy attacks (Attacks 3, 16, 41) in the level-sensory signals were detected by TABOR. Our causal-based approach, such as the CNN-based approach [ 14 ], not only detected these attacks via both univariate and multivariate models, but their sensory signals signified the component (level sensor) that was indeed under attack. The dual isolation-forest-based (DIF) framework, as is presented in [ 38 ], was capable of detecting stealthy Attacks 16 and 41, while Attack 3 was missed.…”

“…The specific attack may trigger potential damage in the process of reverse osmosis. IDS-CNN [ 14 ] performed similarly to 1D CNN; however, the method did not recognize Attack 24, in which water quality in SWaT was compromised. Remarkably, our approach identifies all previous attacks that were missed by the alternative methods.…”

“…Univariate models [ 14 , 15 ] can partly alleviate the curse of dimensionality issue since autoregression forecasting models can be generated individually from each transmitted signal within an ICS. Their implementation is relatively easy, and they can be locally deployed directly in control system devices so that latency issues are avoided.…”

Practical Evaluation of Poisoning Attacks on Online Anomaly Detectors in Industrial Control Systems

“…Neural networks (NN) exhibit impressive performance and are now being assisted in many different areas such as medical diagnosis, computer vision, autonomous driving, and cyber attack detection. In particular, these technologies have been introduced to monitor and detect possible incoming cyber attacks that target Industrial Control Systems (ICS), a subset of cyber-physical systems (CPS) [11,12,14,28,29,34,53,52,55,56,18,23,25,40]. Defending these systems is extremely important, since ICSs are central to many areas of industry, energy production, and critical infrastructure, and they are exposed to external threats as they need to be remotely accessible by operators.…”