Data clustering-based anomaly detection in industrial control systems

Kiss, István Z.; Genge, Béla; Haller, Piroska; Sebestyen, Gheorghe

doi:10.1109/iccp.2014.6937009

Cited by 80 publications

(44 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Until now, there are many researches on the machine learning-based anomaly detection in networked control systems, mainly including: clustering technique [30]- [32], neural network [33], [34], Bayes algorithm [21], genetic algorithm [35], fuzzy logic [36], and support vector method [37]- [41]. Furthermore, these approaches have a good adaptability and flexibility, but there are still some insufficiencies in feature extraction of industrial communication behaviors and model parameter optimization.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Double Behavior Characteristics for One-Class Classification Anomaly Detection in Networked Control Systems

Wan

Shang

Zeng

2017

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Abstract-Due to the growing dependencies of information network technology, networked control systems are undergoing a severe blow of cyberattacks, and simply modeling cyberattacks is inadequate and impractical for the detection requirements, because of various vulnerabilities in these systems and the diversities of cyberattacks. Actually, a feasible viewpoint is to identify misbehaviors by constructing a normal model of industrial communication behaviors. However, one of the chief difficulties is how to completely and appropriately summarize industrial communication behaviors according to the specific communication characteristics. In view of process control and data acquisition, this paper associates industrial communication characteristics with the time sequence, and further extracts two distinct behaviors: function control behavior and process data behavior. Based on these double behavior characteristics, we introduce one-class classification to detect the corresponding anomalies, respectively. Besides, we also present the weighted mixed Kernel function and parameter optimization method to improve classification performance. Experimental results clearly demonstrate that the proposed approach has significant advantages of classification accuracy and detection efficiency.Index Terms-Function control behavior, process data behavior, one-class classification, networked control systems.

show abstract

Section: Related Workmentioning

confidence: 99%

“…Furthermore, we first determine the initial cluster centers by the information entropy of each element in all process data sequences, and then use K-means algorithm [32] to reduce the dimension of each process data sequence D i . The detailed algorithm can be described below:…”

Section: B Feature Selection and Extraction For Process Data Behaviormentioning

confidence: 99%

Double Behavior Characteristics for One-Class Classification Anomaly Detection in Networked Control Systems

Wan

Shang

Zeng

2017

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…In 2014 Kiss et al [20] suggest that Modern Networked Critical Infrastructures (NCI), including advanced and physical systems, are introduced to sharp computerized attacks concentrating on the unfaltering operation of these structures. To ensure variation from the norm care, their watched data can be used as a piece of concurrence with data mining methods to make Intrusion Detection Systems (IDS) or Anomaly Detection Systems (ADS).…”

Section: Literature Surveymentioning

confidence: 99%

A critical analysis on intrusion detection techniques

Wange¹,

Sahu²,

Mishra³

2016

IJATEE

View full text Add to dashboard Cite

“…Clustering is used for security analytics for industrial control systems [11] in an networked critical infrastructure (NCI) environment. First, data outputs from various network sensors are arranged as vectors and K-means clustering is applied to group the vectors into clusters.…”

Section: Clustering For Security Analyticsmentioning

confidence: 99%