Abstract:Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

A hybrid evolutionary and machine learning approach for smart city planning: Digital twin approach

Digital twins for sustainable design and management of smart city buildings and municipal infrastructure

Toward an Applied Cyber Security Solution in IoT-Based Smart Grids: An Intrusion Detection System Approach

Smart infrastructure design: Machine learning solutions for securing modern cities

Cyber Kill Chain-Based Hybrid Intrusion Detection System for Smart Grid

Constrained-Differential-Evolution-Based Stealthy Sparse Cyber-Attack and Countermeasure in an AC Smart Grid

CyberDefender: an integrated intelligent defense framework for digital-twin-based industrial cyber-physical systems

Distributed Intrusion Detection System in a Multi-Layer Network Architecture of Smart Grids

Smart Grid Anomaly Detection using a Deep Learning Digital Twin

Leveraging Digital Twins and Intrusion Detection Systems for Enhanced Security in IoT-Based Smart City Infrastructures

Digital Twin for Evaluating Detective Countermeasures in Smart Grid Cybersecurity

Deep Learning for Cybersecurity in Smart Grids: Review and Perspectives

Ensemble Model Based on Hybrid Deep Learning for Intrusion Detection in Smart Grid Networks

Artificial Immune System Based Intrusion Detection In A Distributed Hierarchical Network Architecture Of Smart Grid

Smart Grid: Cyber Attacks, Critical Defense Approaches, and Digital Twin

Hybrid Intrusion Detection System Design for Distributed Energy Resource Systems

Mitigating Missing Rate and Early Cyberattack Discrimination Using Optimal Statistical Approach with Machine Learning Techniques in a Smart Grid

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

Cyber Security in Power Systems Using Meta-Heuristic and Deep Learning Algorithms

Digital twin-driven SDN for smart grid: A deep learning integrated blockchain for cybersecurity

A review on machine learning techniques for secured cyber-physical systems in smart grid networks