Cyberattack Detection Using Deep Generative Models with Variational Inference

Chandy, Sarin E.; Rasekh, Amin; Barker, Zachary A.; Shafiee, M. Ehsan

doi:10.1061/(asce)wr.1943-5452.0001007

Cited by 29 publications

(14 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Chandy et al. [41] used VAE as a deep generation model to simulate network attack detection problems. Osada et al [42] employed VAE as a semi-supervised learning for intrusion detection.…”

Section: Related Workmentioning

confidence: 99%

Improving the Classification Effectiveness of Intrusion Detection by Using Improved Conditional Variational AutoEncoder and Deep Neural Network

Yang

Zheng

et al. 2019

Sensors

211

View full text Add to dashboard Cite

Intrusion detection systems play an important role in preventing security threats and protecting networks from attacks. However, with the emergence of unknown attacks and imbalanced samples, traditional machine learning methods suffer from lower detection rates and higher false positive rates. We propose a novel intrusion detection model that combines an improved conditional variational AutoEncoder (ICVAE) with a deep neural network (DNN), namely ICVAE-DNN. ICVAE is used to learn and explore potential sparse representations between network data features and classes. The trained ICVAE decoder generates new attack samples according to the specified intrusion categories to balance the training data and increase the diversity of training samples, thereby improving the detection rate of the imbalanced attacks. The trained ICVAE encoder is not only used to automatically reduce data dimension, but also to initialize the weight of DNN hidden layers, so that DNN can easily achieve global optimization through back propagation and fine tuning. The NSL-KDD and UNSW-NB15 datasets are used to evaluate the performance of the ICVAE-DNN. The ICVAE-DNN is superior to the three well-known oversampling methods in data augmentation. Moreover, the ICVAE-DNN outperforms six well-known models in detection performance, and is more effective in detecting minority attacks and unknown attacks. In addition, the ICVAE-DNN also shows better overall accuracy, detection rate and false positive rate than the nine state-of-the-art intrusion detection methods.

show abstract

“…Chandy et al. [41] used VAE as a deep generation model to simulate network attack detection problems. Osada et al [42] employed VAE as a semi-supervised learning for intrusion detection.…”

Section: Related Workmentioning

confidence: 99%

Improving the Classification Effectiveness of Intrusion Detection by Using Improved Conditional Variational AutoEncoder and Deep Neural Network

Yang

Zheng

et al. 2019

Sensors

211

View full text Add to dashboard Cite

show abstract

“…and applying the triangle inequality and subsequently using Equations (2a), (4b), and (5). If Equation (16) holds,…”

Section: Randomized Lempc Changes To Probe For Cyberattacks: Stabilmentioning

confidence: 99%

“…In light of this, attack detection has received focus in the literature (e.g., References 3,4). Attack detection methods for cyber‐physical systems have included those which are data based for applications such as water systems 5 and smart grids 6 . In addition, resilient control designs based on state estimation have been developed for handling and detecting attacks.…”

Section: Introductionmentioning

confidence: 99%

Integrated cyberattack detection and resilient control strategies using Lyapunov‐based economic model predictive control

Oyama

Durand

2020

AIChE Journal

View full text Add to dashboard Cite

The use of an integrated system framework, characterized by numerous cyber/physical components (sensor measurements, signals to actuators) connected through wired/wireless networks, has not only increased the ability to control industrial systems but also the vulnerabilities to cyberattacks. State measurement cyberattacks could pose threats to process control systems since feedback control may be lost if the attack policy is not thwarted. Motivated by this, we propose three detection concepts based on Lyapunov-based economic model predictive control (LEMPC) for nonlinear systems. The first approach utilizes randomized modifications to an LEMPC formulation online to potentially detect cyberattacks. The second method detects attacks when a threshold on the difference between state measurements and state predictions is exceeded. Finally, the third strategy utilizes redundant state estimators to flag deviations from "normal" process behavior as cyberattacks.

show abstract

“…The authors in [15] use first operational variables to check whether physical and/or operating rules have been violated, and the generated set of flagged events feeds a deep learning method based on a convolutional variational auto-encoder to calculate the probability for measured data being anomalous.…”

Section: Related Workmentioning

confidence: 99%

Cyber-Attack Detection in Water Distribution Systems Based on Blind Sources Separation Technique

Brentan

Rezende

Barros

et al. 2021

Water

View full text Add to dashboard Cite

Service quality and efficiency of urban systems have been dramatically boosted by various high technologies for real-time monitoring and remote control, and have also gained privileged space in water distribution. Monitored hydraulic and quality parameters are crucial data for developing planning, operation and security analyses in water networks, which makes them increasingly reliable. However, devices for monitoring and remote control also increase the possibilities for failure and cyber-attacks in the systems, which can severely impair the system operation and, in extreme cases, collapse the service. This paper proposes an automatic two-step methodology for cyber-attack detection in water distribution systems. The first step is based on signal-processing theory, and applies a fast Independent Component Analysis (fastICA) algorithm to hydraulic time series (e.g., pressure, flow, and tank level), which separates them into independent components. These components are then processed by a statistical control algorithm for automatic detection of abrupt changes, from which attacks may be disclosed. The methodology is applied to the case study provided by the Battle of Attack Detection Algorithms (BATADAL) and the results are compared with seven other approaches, showing excellent results, which makes this methodology a reliable early-warning cyber-attack detection approach.

show abstract

Cyberattack Detection Using Deep Generative Models with Variational Inference

Cited by 29 publications

References 24 publications

Improving the Classification Effectiveness of Intrusion Detection by Using Improved Conditional Variational AutoEncoder and Deep Neural Network

Improving the Classification Effectiveness of Intrusion Detection by Using Improved Conditional Variational AutoEncoder and Deep Neural Network

Integrated cyberattack detection and resilient control strategies using Lyapunov‐based economic model predictive control

Cyber-Attack Detection in Water Distribution Systems Based on Blind Sources Separation Technique

Contact Info

Product

Resources

About