Abstract:<p>Industrial Cyber-physical systems (ICPSs), integrating communication, computation and control of industrial processes are referred to as a core technology to approach the <em>Industry 4.0</em>. Ensuring the ICPS security is of paramount importance in smart manufacturing. Considering the characteristics of large-scale, geographically-dispersed and multi-dimensional heterogeneous, federated and life-critical natures of ICPSs, this paper investigates a hierarchically distributed intrusion detection scheme that seeks to achieve the all-round safety protection of ICPSs according to the system structure and attacking types of each ICPS layer. For physical system-relevant perceptual executive layer, potential and covert attacks are detected by the clustered sensory system state residual anomaly monitoring based on a process noise and measurement noise-adaptive Kalman filter (PNMN-AKF). PNMN-AKF can perform a joint recursive estimation of dynamic system states, time-varying process and measurement noise covariance matrices by the variational Bayes approximation framework. In cyberspace, potential cyber-attacks are detected by the anomaly monitoring of the statistical distribution of the network transmission characteristics of data transmission layer by introducing a forgetting factor-induced recursive Gaussian mixture model (FF-RGMM). In the application control layer, a regularized sparse deep belief network model is introduced to characterize the misuse behavior for detecting potential attacks. Extensive validation and comparative experiments have been conducted on a numerical simulation system and a comprehensive ICPS simulation platform by using OPNET and a commonly-used benchmark simplified Tennessee Eastman process (STEP) based on Matlab/Simulink. Experimental results demonstrate that the proposed hierarchically distributed intrusion detection method can efficiently recognize potential and covert cyber-attacks in each ICPSs link with low false alarm rate and missing detection rate, which lays a foundation for the overall security monitoring of ICPSs.</p>

Interval forecasting of cyber-attacks on industrial control systems

Time series forecasting of cyber attack intensity

Cascading Failures of Power System with the Consideration of Cyber Attacks.

Hidden Markov Model-Based Attack Detection for Networked Control Systems Subject to Random Packet Dropouts

Cyber Attacks Against Enterprise Networks: Characterization, Modeling and Forecasting.

Ensuring Cyberattack-Resilient Load Forecasting with A Robust Statistical Method

Assessing the Physical Impact of Cyberattacks on Industrial Cyber-Physical Systems

Predicting Cyber Attack Rates with Extreme Values

AI-based Identification of Most Critical Cyberattacks in Industrial Systems

Exploring Physical-Based Constraints in Short-Term Load Forecasting: A Defense Mechanism Against Cyberattack

A holistic and proactive approach to forecasting cyber threats

Impact Assessment of Hypothesized Cyberattacks on Interconnected Bulk Power Systems

Efficient Cyberattack Detection Methods in Industrial Control Systems

Asset-Based Dynamic Impact Assessment of Cyberattacks for Risk Analysis in Industrial Control Systems

Toward security monitoring of industrial Cyber-Physical systems via hierarchically distributed intrusion detection

Dynamic Data Injection Attack Detection of Cyber Physical Power Systems with Uncertainties

Integrated Approach to Diagnostics of Failures and Cyber-Attacks in Industrial Control Systems

Fuzzy approach on modelling cyber attacks patterns on data transfer in industrial control systems

Spatiotemporal patterns and predictability of cyberattacks

Advanced security testing using a cyber‐attack forecasting model: A case study of financial institutions