Abstract:Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

A Novel Method to Prevent Misconfigurations of Industrial Automation and Control Systems

An Improved Support Vector Machine Attack Detection Algorithm for Industry Controls System

An Engineering-Effective Adaptive Model Algorithm Control (AMAC) and Simulation

Dynamic Network Slicing Orchestration for Remote Adaptation and Configuration in Industrial IoT

Automated diagnosis of software misconfigurations based on static analysis

Detecting Cyberattacks in Industrial Control Systems Using Online Learning Algorithms

Design of Efficient Based Artificial Intelligence Approaches for Sustainable of Cyber Security in Smart Industrial Control System

A data‐driven safety preserving control architecture for constrained cyber‐physical systems

A Data-Driven Safety Preserving Control Architecture for Constrained Cyber-Physical Systems

Automated Reasoning and Detection of Specious Configuration in Large Systems with Symbolic Execution

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

Combining ensemble methods and social network metrics for improving accuracy of OCSVM on intrusion detection in SCADA systems

A Novel Approach for Traffic Anomaly Detection in Power Distributed Control System and Substation System.

A Novel Framework for Industrial Control System Malicious Code Analysis

Towards Context Consistency by Concurrent Checking for Internetware Applications

An Intrusion Detection Method for Industrial Control System against Stealthy Attack

Distributed Collaborative Control for Industrial Automation with Wireless Sensor and Actuator Networks

Trust-AoI-Aware Codesign of Scheduling and Control for Edge-Enabled IIoT Systems

Practical and accurate pinpointing of configuration errors using static analysis

Design of Fully Intelligent Quality Error Prevention System for Tobacco Production Line Based on Configuration Software and PLC Program

An IIoT-Based Networked Industrial Control System Architecture to Secure Industrial Applications