Abstract:Industrial control systems are critical to the operation of industrial facilities, especially for critical infrastructures, such as refineries, power grids, and transportation systems. Similar to other information systems, a significant threat to industrial control systems is the attack from cyberspace---the offensive maneuvers launched by "anonymous" in the digital world that target computer-based assets with the goal of compromising a system's functions or probing for information. Owing to the importance of industrial control systems, and the possibly devastating consequences of being attacked, significant endeavors have been attempted to secure industrial control systems from cyberattacks. Among them are intrusion detection systems that serve as the first line of defense by monitoring and reporting potentially malicious activities. Classical machine-learning-based intrusion detection methods usually generate prediction models by learning modest-sized training samples all at once. Such approach is not always applicable to industrial control systems, as industrial control systems must process continuous control commands with limited computational resources in a nonstop way. To satisfy such requirements, we propose using online learning to learn prediction models from the controlling data stream. We introduce several state-of-the-art online learning algorithms categorically, and illustrate their efficacies on two typically used testbeds---power system and gas pipeline. Further, we explore a new cost-sensitive online learning algorithm to solve the class-imbalance problem that is pervasive in industrial intrusion detection systems. Our experimental results indicate that the proposed algorithm can achieve an overall improvement in the detection rate of cyberattacks in industrial control systems.

Detecting Time Synchronization Attacks in Cyber-Physical Systems with Machine Learning Techniques.

Filter-based Detection and Location of Dynamic Load Altering Attack in Power Cyber-Physical Systems

DoS Attacks in Electrical Cyber-Physical Systems: A Case Study Using TrueTime Simulation Tool

Square Wave Attack Detection Based on PCA with Cosine Similarity and SVM

Multiple Attacks Detection in Cyber-Physical Systems Using Random Finite Set Theory.

Learning-Based Simultaneous Detection and Characterization of Time Delay Attack in Cyber-Physical Systems

An Ensemble Learning-Based Cyber-Attacks Detection Method of Cyber-Physical Power Systems

Real-time Cyber-Physical Security Solution Leveraging an Integrated Learning-Based Approach

Fast Attack Detection for Cyber-Physical Systems Using Dynamic Data Encryption

Differential Evolution-Based Three Stage Dynamic Cyber-Attack of Cyber-Physical Power Systems

Temporal false data injection attack and detection on cyber‐physical power system based on deep reinforcement learning

A Data-Driven Fault Detection Framework Using Mahalanobis Distance Based Dynamic Time Warping

Cybersecurity Analysis of Data-Driven Power System Stability Assessment

Enhanced Resilient Sensor Attack Detection Using Fusion Interval and Measurement History

A Deep Learning based Detection Method for Combined Integrity-Availability Cyber Attacks in Power System

Novel cyber-physical collaborative detection and localization method against dynamic load altering attacks in smart energy grids

Deep Learning Based Attack Detection for Cyber-Physical System Cybersecurity: A Survey

Detecting Cyberattacks in Industrial Control Systems Using Online Learning Algorithms

Real-time Detecting False Data Injection Attacks Based on Spatial and Temporal Correlations

Sensor Attack Detection Using History Based Pairwise Inconsistency.

An Underestimated Cybersecurity Problem: Quick-Impact Time Synchronization Attacks and a Fast-Triggered Detection Method