E-SFD: Explainable Sensor Fault Detection in the ICS Anomaly Detection System

Hwang, Chanwoong; Lee, Taejin

doi:10.1109/access.2021.3119573

Cited by 36 publications

(30 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Even though the combination of solutions to solve the black-box problem of DNN helps domain experts intuitively access the insight of the DNN algorithms, classification accuracy improvement is required when producing predictions in the test set. Very recently, the authors in [21] have proposed to use XAI to interpret anomaly detection outcomes of the multiple Bi-LSTM learning models in an ICS ecosystem. The scope of the ICS is the smart factory of steam-turbine power generation and pumped-storage hydropower generation.…”

Section: Related Workmentioning

confidence: 99%

Federated Learning-Based Explainable Anomaly Detection for Industrial Control Systems

Hương

Bac

et al. 2022

IEEE Access

View full text Add to dashboard Cite

We are now witnessing the rapid growth of advanced technologies and their application, leading to Smart Manufacturing (SM). The Internet of Things (IoT) is one of the main technologies used to enable smart factories, which is connecting all industrial assets, including machines and control systems, with the information systems and the business processes. Industrial Control Systems of smart IoT-based factories are one of the top industries attacked by numerous threats, especially unknown and novel attacks. As a result, with the distributed structure of plenty of IoT front-end sensing devices in SM, an effectively distributed anomaly detection (AD) architecture for IoT-based ICSs should: achieve high detection performance, train and learn new data patterns in a fast time scale, and have lightweight to be deployed on resource-constrained edge devices. To date, most solutions for anomaly detection have not fulfilled all of these requirements. In addition, the interpretability of why an instance is predicted to be abnormal is hardly concerned. In this paper, we propose the so-called FedeX architecture to address those challenges. The experiments show that FedeX outperforms 14 other existing anomaly detection solutions on all detection metrics with the liquid storage data set. And with Recall of 1 and F1-score of 0.9857, it also outperforms those solutions on the SWAT data set. FedeX is also proven to be fast in terms of training time of about 7.5 minutes and lightweight in terms of hardware requirement with memory consumption of 14%, allowing us to deploy anomaly detection tasks on top of edge computing infrastructure and in real-time. Besides, FedeX is considered as one of the frameworks at the forefront of interpreting the predicted anomalies by using XAI, which enables experts to make quick decisions and trust the model more.

show abstract

Section: Related Workmentioning

confidence: 99%

Federated Learning-Based Explainable Anomaly Detection for Industrial Control Systems

Hương

Bac

et al. 2022

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Moreover, the model in [21] consisted of CNN and LSTM. In [22], the author proposed an explainable anomaly detection method based on Bi-directional LSTM (BiLSTM). In [23], the LSTM was used in a Variational AutoEncoder (VAE), and the model can measure anomaly score by calculating reconstruction error.…”

Section: Related Workmentioning

confidence: 99%

Hybrid Cloud-Edge Collaborative Data Anomaly Detection in Industrial Sensor Networks

Yang¹,

Wang²,

Hao³

et al. 2022

Preprint

View full text Add to dashboard Cite

Industrial control systems (ICSs) are facing increasing cyber-physical attacks that can cause catastrophes in the physical system. Efficient anomaly detection models in the industrial sensor networks are essential for enhancing ICS reliability and security, due to the sensor data is related to the operational state of the ICS. Considering the limited availability of computing resources, this paper proposes a hybrid anomaly detection approach in cloud-edge collaboration industrial sensor networks. The hybrid approach consists of sensor data detection models deployed at the edges and a sensor data analysis model deployed in the cloud. The sensor data detection model based on Gaussian and Bayesian algorithms can detect the anomalous sensor data in real-time and upload them to the cloud for further analysis, filtering the normal sensor data and reducing traffic load. The sensor data analysis model based on Graph convolutional network, Residual algorithm and Long short-term memory network (GCRL) can effectively extract the spatial and temporal features and then identify the attack precisely. The proposed hybrid anomaly detection approach is evaluated using a benchmark dataset and baseline anomaly detection models. The experimental results show that the proposed approach can achieve an overall 11.19% increase in Recall and an impressive 14.29% improvement in F1-score, compared with the existing models.

show abstract

“…In particular, the supervised learning method provides a separate label, so it is easy to build the requirements for the model to discriminate effectively, and it has been adopted in many studies [10][11][12]. However, it maintains a long cycle and operates for an extended period without interruption in actual ICS; the training data ratio is unbalanced due to the low frequency of abnormal data occurring during operation [13,14]. There are clear limitations that increase the risk of overfitting and reduce the detection performance of the model [14].…”

Section: Related Work and Establishment Requirements For Performance ...mentioning

confidence: 99%

“…However, it maintains a long cycle and operates for an extended period without interruption in actual ICS; the training data ratio is unbalanced due to the low frequency of abnormal data occurring during operation [13,14]. There are clear limitations that increase the risk of overfitting and reduce the detection performance of the model [14]. Ultimately, to improve the model's performance in the ICS environment, it is necessary to set the prerequisites for performing unsupervised or semi-supervised learning.…”

Section: Related Work and Establishment Requirements For Performance ...mentioning

confidence: 99%

“…In addition, anomaly detection can be approached in various ways depending on the data type. The anomaly detection data set applied in the existing anomaly detection research case based on the ICT environment has a sequential form and the test case does not follow the typical behavior pattern and main goal is to find data that do not exist [14]. However, in the ICS environment, the physical process has data in which the physical process is complicatedly intertwined according to the driving cycle or workflow, and the data has a contextual form in which the data changes according to the relationship between time and the workflow performed in the preceding time [15].…”

Section: Related Work and Establishment Requirements For Performance ...mentioning

confidence: 99%

See 1 more Smart Citation

Improving Method of Anomaly Detection Performance for Industrial IoT Environment

Kim¹,

Shin²,

Park³

et al. 2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

Industrial Control System (ICS), which is based on Industrial IoT (IIoT), has an intelligent mobile environment that supports various mobility, but there is a limit to relying only on the physical security of the ICS environment. Due to various threat factors that can disrupt the workflow of the IIoT, machine learning-based anomaly detection technologies are being presented; it is also essential to study for increasing detection performance to minimize model errors for promoting stable ICS operation. In this paper, we established the requirements for improving the anomaly detection performance in the IIoT-based ICS environment by analyzing the related cases. After that, we presented an improving method of the performance of a machine learning model specialized for IIoT-based ICS, which increases the detection rate by applying correlation coefficients and clustering; it provides a mechanism to predict thresholds on a per-sequence. Likewise, we adopted the HAI dataset environment that actively reflected the characteristics of IIoT-based ICS and demonstrated that performance could be improved through comparative experiments with the traditional method and our proposed method. The presented method can further improve the performance of commonly applied error-based detection techniques and includes a primary method that can be enhanced over existing detection techniques by analyzing correlation coefficients between features to consider feedback between ICS components. Those can contribute to improving the performance of several detection models applied in ICS and other areas.

show abstract

E-SFD: Explainable Sensor Fault Detection in the ICS Anomaly Detection System

Cited by 36 publications

References 35 publications

Federated Learning-Based Explainable Anomaly Detection for Industrial Control Systems

Federated Learning-Based Explainable Anomaly Detection for Industrial Control Systems

Hybrid Cloud-Edge Collaborative Data Anomaly Detection in Industrial Sensor Networks

Improving Method of Anomaly Detection Performance for Industrial IoT Environment

Contact Info

Product

Resources

About