Abstract:Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

Time Series Anomaly Detection for ICS via Multidimensional Features and Spectral Residuals

Cross-domain Anomaly Detection for Power Industrial Control System

An Anomaly Detection and Scenario Classification Scheme Based on Fuzzy C-means Clustering

Anomaly Detection Scheme Using Time Series Analysis for Industrial Control Systems

Anomaly Detection Method for Industrial Control System Operation Data Based on Time-Frequency Fusion Feature Attention Encoding

Anomaly Detection for Industrial Control Networks using Machine Learning with the help from the Inter-Arrival Curves

STFT-TCAN: A TCN-attention Based Multivariate Time Series Anomaly Detection Architecture with Time-Frequency Analysis for Cyber-Industrial Systems

Anomaly Detection for Multivariate Time Series in IoT Using Discrete Wavelet Decomposition and Dual Graph Attention Networks

Anomaly detection of industrial state quantity time-Series data based on correlation and long short-term memory

Anomaly Detection in Industrial Autonomous Decentralized System Based on Time Series.

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

Design And Analysis Of Multimodel-Based Anomaly Intrusion Detection Systems In Industrial Process Automation

A Comparative Study of Time Series Anomaly Detection Models for Industrial Control Systems

MTS Anomaly Detection Based on Temporal and Feature Correlation

Real-Time Deep Anomaly Detection Framework for Multivariate Time-Series Data in Industrial IoT

Correlation-Based Anomaly Detection Method for Multi-sensor System

Unsupervised Multivariate Time Series Data Anomaly Detection in Industrial IoT: A Confidence Adversarial Autoencoder Network

Anomaly Detection Method of ICS Based on Behavior Model

Detecting Anomalies in Distributed Control Systems by Modeling Traffic Behaviors

Anomaly Detection of Industrial Multi-Sensor Signals Based on Enhanced Spatiotemporal Features

An Anomaly Detectionmethod to Improve the Intelligent Level of Smart Articles Based Onmultiple Group Correlation Probabilitymodels