Cyber-Attack Detection for Industrial Control System Monitoring with Support Vector Machine Based on Communication Profile

Terai, Asuka; Abe, Shingo; Kojima, Shoya; Takano, Y.; Koshijima, Ichiro

doi:10.1109/eurospw.2017.62

Cited by 37 publications

(32 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [16], the authors proposed Support Vector Machine (SVM)-based technique to detect cyber-attacks on Industrial Control Systems (ICS) based on communication profile. They employed SVM with different optimization of the hyperparameters to classify malicious and benign traffic on their own testbed.…”

Section: A Supervised Machinel Learning Papersmentioning

confidence: 99%

“…Each process dependent on the previous one and having one dedicated separate PLC. They used nine supervised machine learning (ML) algorithms: Neural Networks (NNs), SVM, Logistic Regression (LR), Random Forest (RF), J48, Best-First Tree (BFTree), Bayesian Network (BayesNet), Naive Bayes (NB) and Instance-based Learning [16](IBK) with various parameter values to find the best parameters for each classifier. They employed 18 attacks from 10 different types to build the model for their nine machine learning algorithms.…”

Section: A Supervised Machinel Learning Papersmentioning

confidence: 99%

“…Additionally, unlike [18], our selected features are comprehensively explained and discussed. Furthermore, unlike [16], we have measured more features in our testbeds to achieve a better classification accuracy. Based on our best knowledge we could not find any research papers proposing a supervised machine learning approach based on energy consumption metrics on a Festo MPA Process Control Rig.…”

Section: B Un-supervised Machinel Learning Papersmentioning

confidence: 99%

See 2 more Smart Citations

A supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system

Robles-Durazno

Moradpoor

McWhinnie

et al. 2018

2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

View full text Add to dashboard Cite

Industrial Control Systems are part of our daily life in industries such as transportation, water, gas, oil, smart cities, and telecommunications. Technological development over time have improved their components including operating system platforms, hardware capabilities, and connectivity with networks inside and outside the organization. Consequently, the Industrial Control Systems components are exposed to sophisticated threats with weak security mechanism in place. This paper proposes a supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system. A testbed of such a system is implemented using the Festo MPA Control Process Rig. The machine-learning algorithms, which include SVN, KNN, and Random Forest, perform classification tasks process in three different datasets obtained from the testbed. The algorithms are compared in terms of accuracy and F-measure. The results show that Random Forest achieves 5% better performance over KNN and SVM with small datasets and 4% regarding large datasets. For the time taken to build the model, KNN presents the best performance. However, its difference with Random Forest is smaller than with SVM.

show abstract

Section: A Supervised Machinel Learning Papersmentioning

confidence: 99%

Section: A Supervised Machinel Learning Papersmentioning

confidence: 99%

Section: B Un-supervised Machinel Learning Papersmentioning

confidence: 99%

See 1 more Smart Citation

A supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system

Robles-Durazno

Moradpoor

McWhinnie

et al. 2018

2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

View full text Add to dashboard Cite

show abstract

“…In [8], a Support Vector Machine (SVM) was employed, and a proposed an Intrusion Detection System (IDS) with a discriminant model to detect cyber-attacks on Industrial Control Systems (ICS) was presented. Their proposed model was based on a communication profile analysis which considers only packet intervals and packet length.…”

Section: Related Workmentioning

confidence: 99%

Implementation and Detection of Novel Attacks to the PLC Memory of a Clean Water Supply System

Robles-Durazno

Moradpoor

McWhinnie

et al. 2018

Communications in Computer and Information Science

View full text Add to dashboard Cite

Critical infrastructures such as nuclear plants or water supply systems are mainly managed through electronic control systems. Such systems comprise of a number of elements, such as programmable logic controllers (PLC), networking devices, and actuators. With the development of online and networking solutions, such electronic control systems can even be managed online. Even though network connected control systems permit users to keep up to date with system operation, it also opens the door to attackers taking advantages of such availability. In this paper, a novel attack vector for modifying PLC memory is proposed, which affects the perceived values of sensors, such as a water flow meter, or the configuration of actuators, such as a pump. In addition, this attack vector can also manipulate control variables located in the PLC working memory, reprogramming decision making rules. To show the impact of the attacks in a real scenario, a model of a clean water supply system is implemented in the Festo rig. The results show that the attacks on the PLC memory can have a significant detrimental effect on control system operations. Further, a mechanism of detecting such attacks on the PLC memory is proposed based on monitoring energy consumption and electrical signals using current-measurement sensors. The results show the successful implementation of the novel PLC attacks as well as the feasibility of detecting such attacks.

show abstract

“…Furthermore, the normal models or profiles are built from multivariate training data, and the corresponding anomaly detection is realized by using the mechanism of classification or optimization. Actually, the computational intelligence techniques have been attracting great interests of both industry and academia, and many computational intelligence approaches have been researched, mainly including SVM (Support Vector Method) [15,24,25], neural network [26], decision trees [27], genetic algorithm [27,28], and clustering technique [29]. Although the computational intelligence-based techniques have the relatively high computational overhead, they can achieve better performance in detection, tolerance, and generality [14].…”

Section: Related Workmentioning

confidence: 99%

Function-Aware Anomaly Detection Based on Wavelet Neural Network for Industrial Control Communication

Wan

Song

Yuan

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

Function control, which is an essential link in industrial automation, is undergoing a growing integration with ICTs (Information Communication Technologies) because of the flexible manufacturing and convenient interoperability in CPSs (Cyber-Physical Systems). However, it has also brought the increasing dangers of cyberattacks caused by malicious or intentional industrial process control exploitations. In order to effectively detect these cyber intrusions and anomalies, this paper proposes a function-aware anomaly detection approach based on WNN (Wavelet Neural Network), which perceives the abnormal function control changes in industrial control communication. By appropriately extracting the time-related function control characteristics from industrial communication packets, this approach builds an optimized wavelet neural network to model the normal function control behaviors and calculates the detection threshold to differentiate the aberrant industrial process control activities. Additionally, a real-world control system, whose communication protocol is Modbus/TCP, is simulated to furnish the analyzed function control data. According to the experimental results, we fully demonstrate this approach has the fine detection accuracy and adequate real-time capability.

show abstract

Cyber-Attack Detection for Industrial Control System Monitoring with Support Vector Machine Based on Communication Profile

Cited by 37 publications

References 11 publications

A supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system

A supervised energy monitoring-based machine learning approach for anomaly detection in a clean water supply system

Implementation and Detection of Novel Attacks to the PLC Memory of a Clean Water Supply System

Function-Aware Anomaly Detection Based on Wavelet Neural Network for Industrial Control Communication

Contact Info

Product

Resources

About