Abstract:Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

Malicious Synchrophasor Detection Based on Highly Imbalanced Historical Operational Data

Fast Sequence Component Analysis for Attack Detection in Synchrophasor Networks

Online Anomaly Detection Using Machine Learning and HPC for Power System Synchrophasor Measurements

Theft of Electricity Detection Based on Supervised Learning

Cost-Effective Bad Synchrophasor Data Detection Based on Unsupervised Time Series Data Analytics

Model-free based Real-time Authentication Framework for Distributed Synchrophasors

Attack detection for spoofed synchrophasor measurements using segmentation network

Precise Recovery of Corrupted Synchrophasors Based on Autoregressive Bayesian Low-Rank Factorization and Adaptive K-Medoids Clustering

A Hybrid Deep Learning Model for Malicious Behavior Detection

A Novel Detection Method for Supersynchronous Resonance From Synchrophasor Data

A machine learning-based detection framework against intermittent electricity theft attack

Anomaly Detection with Ensemble of Encoder and Decoder

Imbalance Learning Machine-Based Power System Short-Term Voltage Stability Assessment

Machine Learning to detect cyber-attacks and discriminating the types of power system disturbances

A data-driven algorithm to detect false data injections targeting both frequency regulation and market operation in power systems

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

Abnormal Electricity Detection with Hybrid Deep Neural Network Model

Automated Sensor Node Malicious Activity Detection with Explainability Analysis

A Deep Learning Approach to Anomaly Sequence Detection for High-Resolution Monitoring of Power Systems

Distributed denial-of-service attack detection for smart grid wide area measurement system: A hybrid machine learning technique

Bayesian High-Rank Hankel Matrix Completion for Nonlinear Synchrophasor Data Recovery