A Variational Autoencoder Framework for Robust, Physics-Informed Cyberattack Recognition in Industrial Cyber-Physical Systems

Navid Aftabi,Dan Li,Paritosh Ramanan
2023-10-11
Abstract:Cybersecurity of Industrial Cyber-Physical Systems is drawing significant concerns as data communication increasingly leverages wireless networks. A lot of data-driven methods were develope for detecting cyberattacks, but few are focused on distinguishing them from equipment faults. In this paper, we develop a data-driven framework that can be used to detect, diagnose, and localize a type of cyberattack called covert attacks on networked industrial control systems. The framework has a hybrid design that combines a variational autoencoder (VAE), a recurrent neural network (RNN), and a Deep Neural Network (DNN). This data-driven framework considers the temporal behavior of a generic physical system that extracts features from the time series of the sensor measurements that can be used for detecting covert attacks, distinguishing them from equipment faults, as well as localize the attack/fault. We evaluate the performance of the proposed method through a realistic simulation study on a networked power transmission system as a typical example of ICS. We compare the performance of the proposed method with the traditional model-based method to show its applicability and efficacy.
Machine Learning,Systems and Control
What problem does this paper attempt to address?
The paper aims to address cybersecurity issues in Industrial Control Systems (ICS), specifically how to distinguish between cyber-attacks and equipment failures, and accurately locate these anomalous events. Specifically, the paper develops a data-driven framework for detecting, diagnosing, and locating a type of cyber-attack known as covert attacks in networked industrial control systems. This framework combines Variational Autoencoders (VAE), Recurrent Neural Networks (RNN), and Deep Neural Networks (DNN) to extract time-series features from sensor data. It not only detects covert attacks but also differentiates them from equipment failures and pinpoints the location of the attack/failure. The method's performance was evaluated through a practical simulation study on a networked power transmission system and compared with traditional model-based approaches, demonstrating its applicability and effectiveness. Additionally, the framework is robust to attack data in the training dataset, reducing the risk of misclassification due to inaccurate historical data labeling.