Abstract:Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

Association Analysis-Based Cybersecurity Risk Assessment for Industrial Control Systems

Industrial control network security situation awareness based on improved C-SVC

Insights on Cooperative Defense for Multiple Industrial Security Technologies

An Anomaly Detection and Scenario Classification Scheme Based on Fuzzy C-means Clustering

Identification of ICS Security Risks Toward the Analysis of Packet Interaction Characteristics Using State Sequence Matching Based on SF-FSM

Threat Assessment for Power Industrial Control System Based on Descriptive Vulnerability Text

Assessing the Physical Impact of Cyberattacks on Industrial Cyber-Physical Systems

Risk assessment for industrial control systems based on asymmetric connection cloud and Choquet integral

A Unified Architectural Approach for Cyberattack-Resilient Industrial Control Systems

A Security Posture Assessment of Industrial Control Systems Based on Evidential Reasoning and Belief Rule Base

An Integrated Cyber-Physical Risk Assessment Framework for Worst-Case Attacks in Industrial Control Systems

Cyber security risk assessment for SCADA and DCS networks

Leveraging Data Fitting and Trust Assessment to Improve the Security of Industrial Networks

Cyber Security Risk Assessment Method for SCADA of Industrial Control Systems

A Survey of Cyber Security and Safety in Industrial Control Systems

Vulnerability Assessment of Industrial Control System with an Improved CVSS

Cybersafety: A System-theoretic Approach to Identify Cyber-vulnerabilities & Mitigation Requirements in Industrial Control Systems

Risk-Based Scheduling of Security Tasks in Industrial Control Systems With Consideration of Safety

Examining Cybersecurity of Cyberphysical Systems for Critical Infrastructures Through Work Domain Analysis

A risk assessment model for similar attack scenarios in industrial control system

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems