Abstract:Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

Industrial Big Data Analytical System in Industrial Cyber-Physical Systems Based on Coarse-to-Fine Deep Network

A Hybrid Deep Neural Network for Nonlinear Causality Analysis in Complex Industrial Control System

Deep Learning-Based Fault Prediction in Wireless Sensor Network Embedded Cyber-Physical Systems for Industrial Processes

A Novel Label-Aware Global Graph Construction Method and Spiking-Coded Graph Neural Network for Intelligent Process Fault Diagnosis

An Unsupervised Anomaly Detection Approach Based On Industrial Big Data

A Neural Network Approach to Analyze FDC Data in Semiconductor Manufacture

Integrating Physics and Data Driven Cyber-Physical System for Condition Monitoring of Critical Transmission Components in Smart Production Line

Industrial Big Data Analysis in Smart Factory: Current Status and Research Strategies

Cloud-Based Data-Intensive Framework Towards Fault Diagnosis In Large-Scale Petrochemical Plants

Industrial Cyberphysical Systems: Realizing Cloud-Based Big Data Infrastructures

Industrial Anomaly Detection and Attack Classification Method Based on Convolutional Neural Network.

Industrial Big Data Analytics for Prediction of Remaining Useful Life Based on Deep Learning

DeepFed: Federated Deep Learning for Intrusion Detection in Industrial Cyber–Physical Systems

One-Dimensional Residual GANomaly Network-Based Deep Feature Extraction Model for Complex Industrial System Fault Detection.

Deep Graph Convolutional Neural Network for Fault Diagnosis of Complex Industrial Processes

Intelligent Edge Sensing and Control Co-Design for Industrial Cyber-Physical System

Method for Detecting Industrial Defects in Intelligent Manufacturing Using Deep Learning

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

Data Analytics-Enable Production Visibility for Cyber-Physical Production Systems

Outlier Detection for Process Monitoring in Industrial Cyber-Physical Systems

Industrial Process Fault Diagnosis Based on Contrastive Clustering-Assisted Discriminative Feature Learning