Toward security monitoring of industrial Cyber-Physical systems via hierarchically distributed intrusion detection

Jinping Liu,Wuxia Zhang,Tianyu Ma,Zhaohui Tang,Yongfang Xie,Weihua Gui,Jean Paul Niyoyita
DOI: https://doi.org/10.1016/j.eswa.2020.113578
IF: 8.5
2020-11-01
Expert Systems with Applications
Abstract:<p>Industrial Cyber-physical systems (ICPSs), integrating communication, computation and control of industrial processes are referred to as a core technology to approach the <em>Industry 4.0</em>. Ensuring the ICPS security is of paramount importance in smart manufacturing. Considering the characteristics of large-scale, geographically-dispersed and multi-dimensional heterogeneous, federated and life-critical natures of ICPSs, this paper investigates a hierarchically distributed intrusion detection scheme that seeks to achieve the all-round safety protection of ICPSs according to the system structure and attacking types of each ICPS layer. For physical system-relevant perceptual executive layer, potential and covert attacks are detected by the clustered sensory system state residual anomaly monitoring based on a process noise and measurement noise-adaptive Kalman filter (PNMN-AKF). PNMN-AKF can perform a joint recursive estimation of dynamic system states, time-varying process and measurement noise covariance matrices by the variational Bayes approximation framework. In cyberspace, potential cyber-attacks are detected by the anomaly monitoring of the statistical distribution of the network transmission characteristics of data transmission layer by introducing a forgetting factor-induced recursive Gaussian mixture model (FF-RGMM). In the application control layer, a regularized sparse deep belief network model is introduced to characterize the misuse behavior for detecting potential attacks. Extensive validation and comparative experiments have been conducted on a numerical simulation system and a comprehensive ICPS simulation platform by using OPNET and a commonly-used benchmark simplified Tennessee Eastman process (STEP) based on Matlab/Simulink. Experimental results demonstrate that the proposed hierarchically distributed intrusion detection method can efficiently recognize potential and covert cyber-attacks in each ICPSs link with low false alarm rate and missing detection rate, which lays a foundation for the overall security monitoring of ICPSs.</p>
computer science, artificial intelligence,engineering, electrical & electronic,operations research & management science
What problem does this paper attempt to address?
### Problems the Paper Aims to Solve This paper aims to address the security monitoring issues of Industrial Cyber-Physical Systems (ICPS), particularly in the context of Industry 4.0, ensuring comprehensive security for large-scale, geographically distributed, and multi-dimensional heterogeneous ICPS systems. Specifically: 1. **Research Background**: - With the development of technologies such as the Internet of Things (IoT) and Cyber-Physical Systems (CPS), ICPS has played a core role in smart manufacturing. - However, due to the increased openness and accessibility of ICPS, various cyber-attacks occur frequently, posing serious security risks to industrial control systems. 2. **Main Issues**: - Traditional information security methods (such as host and network intrusion detection) cannot fully protect the security of ICPS, especially at the physical layer. - The close integration of physical systems and network systems makes ICPS face multi-layered potential threats, requiring a comprehensive security protection scheme. 3. **Solution**: - A layered distributed intrusion detection framework is proposed, combining physical system state anomaly detection and network communication anomaly detection to achieve comprehensive security protection for ICPS. - Specific methods include: - At the Perception Execution Layer (PEL), using Process Noise and Measurement Noise Adaptive Kalman Filter (PNMN-AKF) for distributed sensor system state anomaly detection. - At the Data Transmission Layer (DTL), introducing the Forgetting Factor-induced Recursive Gaussian Mixture Model (FF-RGMM) to monitor statistical distribution anomalies in network transmission characteristics. - At the Application Control Layer (ACL), employing Regularized Sparse Deep Belief Network (RSDBN) to identify potential attack behaviors. Through the above methods, this paper proposes an approach capable of efficiently identifying potential and covert cyber-attacks at various levels of ICPS, thereby laying the foundation for comprehensive security monitoring of ICPS.