Abstract:Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

Physics-informed gated recurrent graph attention unit network for anomaly detection in industrial cyber-physical systems

An Unsupervised Framework for Anomaly Detection in a Water Treatment System

Accurate Anomaly Detection Leveraging Knowledge-enhanced GAT

An Unsupervised Spatiotemporal Graphical Modeling Approach to Anomaly Detection in Distributed CPS

Monitoring industrial control systems via spatio-temporal graph neural networks

A Graph Embedded In Graph Framework With Dual-sequence Input For Efficient Anomaly Detection of Complex Equipment Under Insufficient Samples

Graph Transformer Network Incorporating Sparse Representation for Multivariate Time Series Anomaly Detection

GRU-Based Interpretable Multivariate Time Series Anomaly Detection in Industrial Control System

Anomaly Detection for Data from Unmanned Systems via Improved Graph Neural Networks with Attention Mechanism

Anomaly Detection Model for Large-scale Industrial Systems Using Transfer Entropy and Graph Attention Network

Hybrid Cloud-Edge Collaborative Data Anomaly Detection in Industrial Sensor Networks

Graph Attention Network and Informer for Multivariate Time Series Anomaly Detection

DPDGAD: A Dual-Process Dynamic Graph-based Anomaly Detection for multivariate time series analysis in cyber-physical systems

SPIDARman: System-Level Physics-Informed Detection of Anomalies in Reactor Collected Data Considering Human Errors

Anomaly Detection with Graph Attention Network for Multimodal IoT Data Monitoring

An Attention-Based Deep Generative Model for Anomaly Detection in Industrial Control Systems

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

An Adaptive Pyramid Graph and Variation Residual-Based Anomaly Detection Network for Rail Surface Defects

HRGCN: Heterogeneous Graph-level Anomaly Detection with Hierarchical Relation-augmented Graph Neural Networks

Hybrid Anomaly Detection via Multihead Dynamic Graph Attention Networks for Multivariate Time Series

Graph Neural Networks for Anomaly Detection in Industrial Internet of Things