Log-Based Anomaly Detection of CPS Using a Statistical Method

Abstract

Abstract-Detecting anomalies of a cyber physical system (CPS), which is a complex system consisting of both physical and software parts, is important because a CPS often operates autonomously in an unpredictable environment. However, because of the ever-changing nature and lack of a precise model for a CPS, detecting anomalies is still a challenging task. To address this problem, we propose applying an outlier detection method to a CPS log. By using a log obtained from an actual aquarium management system, we evaluated the effectiveness of our proposed method by analyzing outliers that it detected. By investigating the outliers with the developer of the system, we confirmed that some outliers indicate actual faults in the system. For example, our method detected failures of mutual exclusion in the control system that were unknown to the developer. Our method also detected transient losses of functionalities and unexpected reboots. On the other hand, our method did not detect anomalies that were too many and similar. In addition, our method reported rare but unproblematic concurrent combinations of operations as anomalies. Thus, our approach is effective at finding anomalies, but there is still room for improvement.

A Systematic Framework to Generate Invariants for Anomaly Detection in Industrial Control Systems

“…Log-based anomaly detection via statistical methods has been widely applied to ICS in the recent years [42], [43]. However, most of these approaches either are only applicable to a specific type of systems or require prior domain-specific knowledge about the system to construct the detection model.…”

Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning

“…the survey [15] and textbook [13]). Harada et al [9] applies one of the most widely-used anomaly detection methods, Local Outlier Factor (LOF) [16], to an automated aquarium management system and detects the failure of mutual exclusion. However, LOF is a method to find outliers without prior knowledge of the normal behaviors.…”

“…This research direction is seeing increasing interest (e.g. [8], [9]), but much remains to be understood about how to apply it effectively in practice.…”

Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences

“…Let v s denote the current value of sensor s, L s denote its lower safety threshold, H s denote its upper safety threshold, and r s = H s − L s denote its range of safe values. Let Select k parents from P using Roulette Wheel Selection; 5 Generate new candidates from parents using crossover; 6 Generate new candidates from parents using bit flip mutation with probability pm; 7 Compute fitness of new candidates c with f (M (S, c)); 8 Replace P with the n fittest of the new and old candidates; 9 until timeout; 10 return candidate c ∈ P that maximises f (M (S, c));…”

“…Given the potential to cause massive disruption, such systems have become prime targets for cyber attackers, with a number of successful cases reported in recent years [3], [4]. This pervasive threat faced by CPSs has motivated research and development into a wide variety of attack defence mechanisms, including techniques based on anomaly detection [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], fingerprinting [16], [17], [18], [19], and monitoring conditions or physical invariants [20], [21], [22], [23], [24], [25], [26], [27]. The practical utility of these different countermeasures ultimately depends on how effective they are at their principal goal: detecting and/or preventing attacks.…”