Abstract:<p>Industrial Cyber-physical systems (ICPSs), integrating communication, computation and control of industrial processes are referred to as a core technology to approach the <em>Industry 4.0</em>. Ensuring the ICPS security is of paramount importance in smart manufacturing. Considering the characteristics of large-scale, geographically-dispersed and multi-dimensional heterogeneous, federated and life-critical natures of ICPSs, this paper investigates a hierarchically distributed intrusion detection scheme that seeks to achieve the all-round safety protection of ICPSs according to the system structure and attacking types of each ICPS layer. For physical system-relevant perceptual executive layer, potential and covert attacks are detected by the clustered sensory system state residual anomaly monitoring based on a process noise and measurement noise-adaptive Kalman filter (PNMN-AKF). PNMN-AKF can perform a joint recursive estimation of dynamic system states, time-varying process and measurement noise covariance matrices by the variational Bayes approximation framework. In cyberspace, potential cyber-attacks are detected by the anomaly monitoring of the statistical distribution of the network transmission characteristics of data transmission layer by introducing a forgetting factor-induced recursive Gaussian mixture model (FF-RGMM). In the application control layer, a regularized sparse deep belief network model is introduced to characterize the misuse behavior for detecting potential attacks. Extensive validation and comparative experiments have been conducted on a numerical simulation system and a comprehensive ICPS simulation platform by using OPNET and a commonly-used benchmark simplified Tennessee Eastman process (STEP) based on Matlab/Simulink. Experimental results demonstrate that the proposed hierarchically distributed intrusion detection method can efficiently recognize potential and covert cyber-attacks in each ICPSs link with low false alarm rate and missing detection rate, which lays a foundation for the overall security monitoring of ICPSs.</p>

A Host-based Multi-layer Intrusion Detection Model and Its Detection Methods

Multi-agent based hybrid Intrusion detection system

Intrusion Detection And Simulation For High-Speed Networks

Hybrid Intrusion Detection System for Complicated Network

Intrusion Detection System Model Based on Multi Detection Technology

A Network Intrusion Detection Model Based on BiLSTM with Multi-Head Attention Mechanism

RESEARCH AND IMPLEMENTATION OF INTRUSION DETECTION BASED ON HIERARCHICAL STRUCTURE

Distributed Detection of Network Intrusions Based on a Parametric Model.

An Intrusion Detection Framework Based on Information Fusion

Research and Design of Intrusion Detection Systems Based on SNMP

Data-driven network layer security detection model and simulation for the Internet of Things based on an artificial immune system

A novel multi-scale network intrusion detection model with transformer

A Network Intrusion Detection System Using Hybrid Multilayer Deep Learning Model

A Model of APT Attack Defense Based on Cyber Threat Detection

A Network Traffic Intrusion Detection Method for Industrial Control Systems Based on Deep Learning

Host-Based Network Intrusion Detection via Feature Flattening and Two-stage Collaborative Classifier

Design of an Intrusion Detection Model under Linux Based on System-call Monitoring

Research on Dynamic Adaptive Intrusion Detection Model

A Multi-layer Security Model for Internet of Things

Toward security monitoring of industrial Cyber-Physical systems via hierarchically distributed intrusion detection

Study and Implementation of a Net-based Intrusion Detection System