Abstract:Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

Intrusion Detection Method of Industrial Control System Based on RIPCA-OCSVM

An Improved Support Vector Machine Attack Detection Algorithm for Industry Controls System

Intrusion detection algorithm of industrial control network based on improved one-class support vector machine

Square Wave Attack Detection Based on PCA with Cosine Similarity and SVM

A Hybrid Algorithm Incorporating Vector Quantization and One-Class Support Vector Machine for Industrial Anomaly Detection

Research on Intrusion Detection of Industrial Control System Based on FastICA-SVM Method.

Data-Driven Anomaly Detection Using OCSVM with Boundary Optimzation

A Novel SVM by Combining Kernel Principal Component Analysis and Improved Chaotic Particle Swarm Optimization for Intrusion Detection

A Real-Time Intrusion Detection System Based On Pso-Svm

Real-Time Intrusion Detection Based on Decision Fusion in Industrial Control Systems

Intrusion Detection Using Hybrid Enhanced CSA-PSO and Multivariate WLS Random-Forest Technique

Intrusion Detection Quantitative Analysis with Support Vector Regression and Particle Swarm Optimization Algorithm

An Improved SVM Algorithm in Intrusion Detection Application

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

Time Series Anomaly Detection for ICS via Multidimensional Features and Spectral Residuals

An adaptive network intrusion detection method based on PCA and support vector machines

Industrial network intrusion detection in open-set scenarios

Research on a PSO-H-SVM-Based Intrusion Detection Method for Industrial Robotic Arms

Intrusion Detection System Based on One-Class Support Vector Machine and Gaussian Mixture Model

Robust One-Class SVM for Fault Detection

A Hierarchical Intrusion Detection System for Industrial Control Networks based on EtherNet/IP