Explainable Anomaly Detection for Industrial Control System Cybersecurity

Ha, Do Thu; Hoang, Nguyen Xuan; Hoàng, Nguyễn Viết; Du, Nguyen Huu; Hương, Trương Thu; Tran, Kim Phuc

doi:10.1016/j.ifacol.2022.09.550

Cited by 25 publications

(3 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this section, we summarize prior work that evaluates attributions of ICS anomaly detection. Although prior works have qualitatively evaluated explanations of ICS anomaly detection models with visualizations [18], [30], [37], [62], few prior works have quantitatively evaluated attributions by directly mapping anomaly scores produced from anomalydetection models to the features manipulated in the attack.…”

Section: Prior Work In Attributing Attacks On Icsmentioning

confidence: 99%

Attributions for ML-based ICS Anomaly Detection: From Theory to Practice

Fung,

Zeng,

Bauer

2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Industrial Control Systems (ICS) govern critical infrastructure like power plants and water treatment plants. ICS can be attacked through manipulations of its sensor or actuator values, causing physical harm. A promising technique for detecting such attacks is machine-learning-based anomaly detection, but it does not identify which sensor or actuator was manipulated and makes it difficult for ICS operators to diagnose the anomaly's root cause. Prior work has proposed using attribution methods to identify what features caused an ICS anomaly-detection model to raise an alarm, but it is unclear how well these attribution methods work in practice. In this paper, we compare state-of-the-art attribution methods for the ICS domain with real attacks from multiple datasets. We find that attribution methods for ICS anomaly detection do not perform as well as suggested in prior work and identify two main reasons. First, anomaly detectors often detect attacks either immediately or significantly after the attack start; we find that attributions computed at these detection points are inaccurate. Second, attribution accuracy varies greatly across attack properties, and attribution methods struggle with attacks on categorical-valued actuators. Despite these challenges, we find that ensembles of attributions can compensate for weaknesses in individual attribution methods. Towards practical use of attributions for ICS anomaly detection, we provide recommendations for researchers and practitioners, such as the need to evaluate attributions with diverse datasets and the potential for attributions in non-real-time workflows.

show abstract

Section: Prior Work In Attributing Attacks On Icsmentioning

confidence: 99%

Attributions for ML-based ICS Anomaly Detection: From Theory to Practice

Fung,

Zeng,

Bauer

2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Ha et al [147] further develop strategies for leveraging XAI in IIoT environments by proposing an extension to existing One-Class Support Vector Machine (OCSVM) and LSTM algorithms that solve the human comprehension issue by integrating XAI into the model and generating human-readable explanations of predictive decisions reached by anomaly detection methods using OCSVM and LSTM. The integrated XAI modules interpret the ML predictions for the human operator of the CPS, reducing maintenance costs and accelerating decisions that require human intervention.…”

Section: Using Ai/ml For Anomaly Detectionmentioning

confidence: 99%

A Review of Anomaly Detection Strategies to Detect Threats to Cyber-Physical Systems

Jeffrey,

Tan,

Villar

2023

Electronics

View full text Add to dashboard Cite

Cyber-Physical Systems (CPS) are integrated systems that combine software and physical components. CPS has experienced rapid growth over the past decade in fields as disparate as telemedicine, smart manufacturing, autonomous vehicles, the Internet of Things, industrial control systems, smart power grids, remote laboratory environments, and many more. With the widespread integration of Cyber-Physical Systems (CPS) in various aspects of contemporary society, the frequency of malicious assaults carried out by adversaries has experienced a substantial surge in recent times. Incidents targeting vital civilian infrastructure, such as electrical power grids and oil pipelines, have become alarmingly common due to the expanded connectivity to the public internet, which significantly expands the vulnerability of CPS. This article presents a comprehensive review of existing literature that examines the latest advancements in anomaly detection techniques for identifying security threats in Cyber-Physical Systems. The primary emphasis is placed on addressing life safety concerns within industrial control networks (ICS). A total of 296 papers are reviewed, with common themes and research gaps identified. This paper makes a novel contribution by identifying the key challenges that remain in the field, which include resource constraints, a lack of standardized communication protocols, extreme heterogeneity that hampers industry consensus, and different information security priorities between Operational Technology (OT) and Information Technology (IT) networks. Potential solutions and/or opportunities for further research are identified to address these selected challenges.

show abstract

“…This approach entails training a machine learning model on a dataset that represents normal behavior, enabling it to identify deviations or anomalies effectively [119]. It can help detect abnormal activities, such as network intrusions, system misuse, or suspicious user behavior [120]. The correct detection of unusual events empowers the decision maker to act on the system to correctly avoid, correct, or react to the associated situations [121].…”

Section: Anomaly Detectionmentioning

confidence: 99%

Securing Industrial Control Systems: Components, Cyber Threats, and Machine Learning-Driven Defense Strategies

Nankya,

Chataut,

Akl

2023

Sensors

View full text Add to dashboard Cite

Industrial Control Systems (ICS), which include Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and Programmable Logic Controllers (PLC), play a crucial role in managing and regulating industrial processes. However, ensuring the security of these systems is of utmost importance due to the potentially severe consequences of cyber attacks. This article presents an overview of ICS security, covering its components, protocols, industrial applications, and performance aspects. It also highlights the typical threats and vulnerabilities faced by these systems. Moreover, the article identifies key factors that influence the design decisions concerning control, communication, reliability, and redundancy properties of ICS, as these are critical in determining the security needs of the system. The article outlines existing security countermeasures, including network segmentation, access control, patch management, and security monitoring. Furthermore, the article explores the integration of machine learning techniques to enhance the cybersecurity of ICS. Machine learning offers several advantages, such as anomaly detection, threat intelligence analysis, and predictive maintenance. However, combining machine learning with other security measures is essential to establish a comprehensive defense strategy for ICS. The article also addresses the challenges associated with existing measures and provides recommendations for improving ICS security. This paper becomes a valuable reference for researchers aiming to make meaningful contributions within the constantly evolving ICS domain by providing an in-depth examination of the present state, challenges, and potential future advancements.

show abstract

Explainable Anomaly Detection for Industrial Control System Cybersecurity

Cited by 25 publications

References 18 publications

Attributions for ML-based ICS Anomaly Detection: From Theory to Practice

Attributions for ML-based ICS Anomaly Detection: From Theory to Practice

A Review of Anomaly Detection Strategies to Detect Threats to Cyber-Physical Systems

Securing Industrial Control Systems: Components, Cyber Threats, and Machine Learning-Driven Defense Strategies

Contact Info

Product

Resources

About