Abstract:<p>Industrial Cyber-physical systems (ICPSs), integrating communication, computation and control of industrial processes are referred to as a core technology to approach the <em>Industry 4.0</em>. Ensuring the ICPS security is of paramount importance in smart manufacturing. Considering the characteristics of large-scale, geographically-dispersed and multi-dimensional heterogeneous, federated and life-critical natures of ICPSs, this paper investigates a hierarchically distributed intrusion detection scheme that seeks to achieve the all-round safety protection of ICPSs according to the system structure and attacking types of each ICPS layer. For physical system-relevant perceptual executive layer, potential and covert attacks are detected by the clustered sensory system state residual anomaly monitoring based on a process noise and measurement noise-adaptive Kalman filter (PNMN-AKF). PNMN-AKF can perform a joint recursive estimation of dynamic system states, time-varying process and measurement noise covariance matrices by the variational Bayes approximation framework. In cyberspace, potential cyber-attacks are detected by the anomaly monitoring of the statistical distribution of the network transmission characteristics of data transmission layer by introducing a forgetting factor-induced recursive Gaussian mixture model (FF-RGMM). In the application control layer, a regularized sparse deep belief network model is introduced to characterize the misuse behavior for detecting potential attacks. Extensive validation and comparative experiments have been conducted on a numerical simulation system and a comprehensive ICPS simulation platform by using OPNET and a commonly-used benchmark simplified Tennessee Eastman process (STEP) based on Matlab/Simulink. Experimental results demonstrate that the proposed hierarchically distributed intrusion detection method can efficiently recognize potential and covert cyber-attacks in each ICPSs link with low false alarm rate and missing detection rate, which lays a foundation for the overall security monitoring of ICPSs.</p>

Detection of Covert Cyber-Attacks in Interconnected Systems: A Distributed Model-Based Approach

Attack Detection for Distributed Photovoltaic Generation Systems Leveraging Cyber and Power Side Channel Data

Centralized Versus Decentralized Detection of Attacks in Stochastic Interconnected Systems

Constrained-Differential-Evolution-Based Stealthy Sparse Cyber-Attack and Countermeasure in an AC Smart Grid

Attack Detection in Power Distribution Systems Using a Cyber-Physical Real-Time Reference Model

An Online Approach to Cyberattack Detection and Localization in Smart Grid

Simultaneous Distributed Estimation and Attack Detection/Isolation in Social Networks: Structural Observability, Kronecker-Product Network, and Chi-Square Detector

Distributed Estimation and Detection of Cyber-Physical Attacks in Power Systems

Cyber-Attack Detection in Discrete Nonlinear Multi-Agent Systems Using Neural Networks

Cyber-Physical Attacks in Power Networks: Models, Fundamental Limitations and Monitor Design

Abstraction-based intrusion detection in distributed environments.

Distributed Attack Detection of Multi-area Power Systems Against False Data Injection Attacks

Distributed cyber attack detection and physical fault diagnosis for a class of interconnected large-scale systems

Distributed detection and isolation of topology attacks in power networks

Toward security monitoring of industrial Cyber-Physical systems via hierarchically distributed intrusion detection

A Distributed Intrusion Detection System Using Cooperating Agents

Koopman Operator-based Detection-Isolation of Cyberattack: A Case Study on Electric Vehicle Charging

Detection of Cyber-Attacks in a Discrete Event System Based on Deep Learning

Optimal Detector Placement in Networked Control Systems under Cyber-attacks with Applications to Power Networks

A Hierarchical Model for Distributed Attacks

Privacy-Preserving Stealthy Attack Detection in Multi-Agent Control Systems