Abstract:Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

A Hybrid Approach for Automatic Incident Detection.

An Improved Automatic Traffic Incident Detection Technique Using a Vehicle to Infrastructure Communication

Automatic Incident Classification for Big Traffic Data by Adaptive Boosting SVM

Traffic Collisions Early Warning Aided by Small Unmanned Aerial Vehicle Companion

A Machine Learning Framework for Automated Accident Detection Based on Multimodal Sensors in Cars

A traffic incident detection method of highway based on spatial-temporal characteristics

A data-centric weak supervised learning for highway traffic incident detection

A Fuzzy Pattern Recognition-based Approach to Automatic Freeway Incident Detection

An intelligent traffic detection approach for vehicles on highway using pattern recognition and deep learning

Using Reinforcement Learning With Partial Vehicle Detection for Intelligent Traffic Signal Control

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

APPLYING DATA MINING TECHNIQUES FOR TRAFFIC INCIDENT ANALYSIS

Automatic Detection of Major Freeway Congestion Events Using Wireless Traffic Sensor Data: A Machine Learning Approach

A Hybrid Physics Machine Learning Approach for Macroscopic Traffic State Estimation

Utilizing Import Vector Machines to Identify Dangerous Pro-active Traffic Conditions

A Hybrid Fault Diagnosis Method for Autonomous Driving Sensing Systems Based on Information Complexity

Machine learning framework for end-to-end implementation of Incident duration prediction

Development of image sequences based traffic incident detection system for urban intersection

A Review of Artificial Intelligence and Machine Learning for Incident Detectors in Road Transport Systems

Applying Deep Learning to Detect Traffic Accidents in Real Time Using Spatiotemporal Sequential Data