Abstract:Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

Real-time Cyber-Physical Security Solution Leveraging an Integrated Learning-Based Approach

Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems

Filter-based Detection and Location of Dynamic Load Altering Attack in Power Cyber-Physical Systems

Multiple Attacks Detection in Cyber-Physical Systems Using Random Finite Set Theory.

An Ensemble Learning-Based Cyber-Attacks Detection Method of Cyber-Physical Power Systems

Constructing Cyber-Physical System Testing Suites Using Active Sensor Fuzzing

Real-Time Data-Predictive Attack-Recovery for Complex Cyber-Physical Systems

Deep Learning Based Attack Detection for Cyber-Physical System Cybersecurity: A Survey

A Systematic Analysis of Enhancing Cyber Security Using Deep Learning for Cyber Physical Systems

Real-Time Attack-Recovery for Cyber-Physical Systems Using Linear Approximations

Stealthy False Data Injection Attacks Detection and Classification in Cyber-Physical Systems Using Deep Reinforcement Learning

Coordinated Cyber-Attack Detection Model of Cyber-Physical Power System Based on the Operating State Data Link

Learning-Based Simultaneous Detection and Characterization of Time Delay Attack in Cyber-Physical Systems

Cyber Physical System Based Smart Healthcare System with Deep Learning Architectures with Data Analytics

A Tutorial on Detecting Security Attacks on Cyber-Physical Systems

Integrated Security Threats and Defense of Cyber-physical Systems

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

Digital-Twin-Based CPS Anomaly Diagnosis and Security Defense Countermeasure Recommendation

Detecting Intelligent Load Redistribution Attack Based on Power Load Pattern Learning in Cyber-Physical Power Systems

Fast Attack Detection for Cyber-Physical Systems Using Dynamic Data Encryption

Cyber-physical System Security for Networked Industrial Processes.