Abstract:Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

Multi-Scale Traffic Aware Cybersecurity Situational Awareness Online Model for Intelligent Power Substation Communication Network

On the Modeling and Analysis of Communication Traffic in Intelligent Electric Power Substations

FARIMA Model-Based Communication Traffic Anomaly Detection in Intelligent Electric Power Substations

Industrial control network security situation awareness based on improved C-SVC

FARIMA Model Based Analysis of Communication Traffic Anomaly in Smart Substation

An asymmetric interdependent networks model for cyber-physical systems

Cyber Protection for Malware Attack Resistance in Cyber-Physical Power Systems

Cloud-edge Coordinated Traffic Anomaly Detection for Industrial Cyber-Physical Systems

A cyber-physical model for SCADA system and its intrusion detection

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

CP Fusion based Abnormal Traffic Dedection for Process Layer Network in Digital Substation

A Novel Approach for Traffic Anomaly Detection in Power Distributed Control System and Substation System.

Detecting Anomalies in Intelligent Vehicle Charging and Station Power Supply Systems With Multi-Head Attention Models

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

Data Traffic Characterization in Intelligent Electric Substations Using FARIMA Based Threshold Model

Risk-based contingency analysis for power systems considering a combination of different types of cyber-attacks

Tracking Real-time Anomalies in Cyber-Physical Systems Through Dynamic Behavioral Analysis

Multi-scale Risk Assessment Model of Network Security Based on LSTM

Threat from being Social: Vulnerability Analysis of Social Network Coupled Smart Grid

Digital Substation Cyber Security Analysis with Syn-Flood Attack As A Simulation Case

Research on Substation Network Security Situational Awareness Strategy and Equipment Remote Operation and Maintenance