Abstract:The swift embrace of Industry 4.0 paradigms has led to the growing convergence of Information Technology (IT) networks and Operational Technology (OT) networks. Traditionally isolated on air-gapped and fully trusted networks, OT networks are now becoming more interconnected with IT networks due to the advancement and applications of IoT. This expanded attack surface has led to vulnerabilities in Cyber–Physical Systems (CPSs), resulting in increasingly frequent compromises with substantial economic and life safety repercussions. The existing methods for the anomaly detection of security threats typically use simple threshold-based strategies or apply Machine Learning (ML) algorithms to historical data for the prediction of future anomalies. However, due to the high levels of heterogeneity across different CPS environments, minimizing the opportunities for transfer learning, and the scarcity of real-world data for training, the existing ML-based anomaly detection techniques suffer from a poor predictive performance. This paper introduces a hybrid anomaly detection approach designed to identify threats to CPSs by combining the signature-based anomaly detection typically utilized in IT networks, the threshold-based anomaly detection typically utilized in OT networks, and behavioural-based anomaly detection using Ensemble Learning (EL), which leverages the strengths of multiple ML algorithms against the same dataset to increase the accuracy. Multiple public research datasets were used to validate the proposed approach, with the hybrid methodology employing a divide-and-conquer strategy to offload the detection of certain cyber threats to computationally inexpensive signature-based and threshold-based methods using domain knowledge to minimize the size of the behavioural-based data needed for ML model training, thus achieving a higher accuracy over a reduced timeframe. The experimental results showed accuracy improvements of 4–7% over those of the conventional ML classifiers in performing anomaly detection across multiple datasets, which is particularly important to the operators of CPS environments due to the high financial and life safety costs associated with interruptions to system availability.

Unsupervised Ensemble Methods for Anomaly Detection in PLC-based Process Control

Anomoly Detection for PLC Based on Magnetic Side Channel

An Unsupervised Framework for Anomaly Detection in a Water Treatment System

NIPAD: a Non-Invasive Power-Based Anomaly Detection Scheme for Programmable Logic Controllers

Enhanced Anomaly Detection in Industrial Control Systems aided by Machine Learning

Super Learner Ensemble for Anomaly Detection and Cyber-risk Quantification in Industrial Control Systems

An OpenPLC-based Active Real-time Anomaly Detection Framework for Industrial Control Systems

A Deep Learning Ensemble for Network Anomaly and Cyber-Attack Detection

Using Ensemble Learning for Anomaly Detection in Cyber–Physical Systems

Machine learning for intrusion detection in industrial control systems: challenges and lessons from experimental evaluation

Evaluation of Machine Learning-based Anomaly Detection Algorithms on an Industrial Modbus/TCP Data Set

Anomaly Detection for Industrial Control Networks using Machine Learning with the help from the Inter-Arrival Curves

Recent Advances in Machine Learning-based Anomaly Detection for Industrial Control Networks

Detecting PLC Intrusions Using Control Invariants

Enhancing Critical Infrastructure Security: Unsupervised Learning Approaches for Anomaly Detection

Leveraging Deep Reinforcement Learning Technique for Intrusion Detection in SCADA Infrastructure

Anomaly Detection for Insider Attacks From Untrusted Intelligent Electronic Devices in Substation Automation Systems

An Ensemble Deep Learning-based Cyber-Attack Detection in Industrial Control System

Instruction Detection in SCADA/Modbus Network Based on Machine Learning

Anomaly detection in network traffic with ELSC learning algorithm

Anomaly-Based Intrusion Detection System for Cyber-Physical System Security