Abstract:Traditional security detection methods face challenges in identifying zero-day attacks in critical infrastructures (CIs) integrated with the industrial internet of things (IIoT). These attacks exploit unknown vulnerabilities and are difficult to detect due to their connection to physical systems. The integration of legacy ICS networks with modern computing and networking technologies has significantly expanded the attack surface, making these systems more susceptible to cyber-attacks. Despite existing security measures, attackers continually find ways to breach these operating networks. Anomaly detection systems are critical in protecting these CIs from current cyber threats. This study investigates the effectiveness of unsupervised anomaly detection models in detecting operational anomalies that could lead to cyber-attacks, thereby disrupting and negatively impacting quality of life. We preprocess the data with a focus on cybersecurity and chose the SWAT dataset because it accurately represents the types of attack vectors that critical infrastructures commonly encounter. We evaluated the performance of isolation forest (IF), local outlier factor (LOF), one-class SVM (OCSVM), and Autoencoder algorithms—trained exclusively on normal data—in enhancing cybersecurity within IIoT environments. Our comprehensive analysis includes an assessment of each model's detection capabilities. The findings highlight the VAE-LSTM model's potential to identify cyber-attacks within seconds in a high-frequency dataset, suggesting near real-time detection capability. The final model combines the reconstruction ability of the variational autoencoder (VAE) with regularization using the Kullback–Leibler divergence, reflecting the non-Gaussian nature of industrial system data. Our model successfully detected 23 out of 26 attack scenarios in the SWAT dataset, demonstrating its effectiveness in improving the security of IIoT-based CIs.

Real-time detection of insider attacks on substation automation systems using short length orthogonal wavelet filters and OPAL-RT

Square Wave Attack Detection Based on PCA with Cosine Similarity and SVM

Filter-based Detection and Location of Dynamic Load Altering Attack in Power Cyber-Physical Systems

Detection of Cyber-Attacks and Power Disturbances in Smart Digital Substations using Continuous Wavelet Transform and Convolution Neural Networks

Anomaly Detection for Insider Attacks From Untrusted Intelligent Electronic Devices in Substation Automation Systems

Network Security Situation Awareness for Industrial Control System under Integrity Attacks

Deceptive attack detection of control system using multi-scale principal component analysis

Online Parallel Attack Detection Method for Industrial Control based on Multi-bandpass Filter

A Time-Series Self-Supervised Learning Approach to Detection of Cyber-physical Attacks in Water Distribution Systems

A Reinforcement Learning-Based Detection Method for False Data Injection Attack in Distributed Smart Grid

Efficient Predictive Monitoring of Linear Time-Invariant Systems Under Stealthy Attacks

Attack Detection in Power Distribution Systems Using a Cyber-Physical Real-Time Reference Model

Enhancing Critical Infrastructure Security: Unsupervised Learning Approaches for Anomaly Detection

Cyberattack Detection in Intelligent Grids Using Non-linear Filtering

Stealthy Deception Attacks Against SCADA Systems

A watchdog model for physics-based anomaly detection in digital substations

A Machine Learning Based Framework for Real-Time Detection and Mitigation of Sensor False Data Injection Cyber-Physical Attacks in Industrial Control Systems

SCO-RNN: A Behavioral-Based Intrusion Detection Approach for Cyber Physical Attacks in SCADA Systems

Attack detection for spoofed synchrophasor measurements using segmentation network

Backdoor Attacks for Remote Sensing Data With Wavelet Transform

Tracking Real-time Anomalies in Cyber-Physical Systems Through Dynamic Behavioral Analysis