Deep Learning Based Covert Attack Identification for Industrial Control Systems

Industrial control systems depend heavily on security and monitoring protocols. Several tools are available for this purpose, which scout vulnerabilities and take screenshots of various control panels for later analysis. However, they do not adequately classify images into specific control groups, which is crucial for security-based tasks performed by manual operators. To solve this problem, we propose a pipeline based on deep learning to classify snapshots of industrial control panels into three categories: internet technologies, operation technologies, and others. More specifically, we compare the use of transfer learning and fine-tuning in convolutional neural networks (CNNs) pre-trained on ImageNet to select the best CNN architecture for classifying the screenshots of industrial control systems. We propose the critical infrastructure dataset (CRINF-300), which is the first publicly available information technology (IT)/operational technology (OT) snapshot dataset, with 337 manually labeled images. We used the CRINF-300 to train and evaluate eighteen different pipelines, registering their performance under CPU and GPU environments. We found out that the Inception-ResNet-V2 and VGG16 architectures obtained the best results on transfer learning and fine-tuning, with F1-scores of 0.9832 and 0.9373, respectively. In systems where time is critical and the GPU is available, we recommend using the MobileNet-V1 architecture, with an average time of 0.03 s to process an image and with an F1-score of 0.9758.

Download Full-text

System-Wide Anomaly Detection of Industrial Control Systems via Deep Learning and Correlation Analysis

IFIP Advances in Information and Communication Technology - Artificial Intelligence Applications and Innovations ◽

10.1007/978-3-030-79150-6_29 ◽

2021 ◽

pp. 362-373

Author(s):

Gordon Haylett ◽

Zahra Jadidi ◽

Kien Nguyen Thanh

Keyword(s):

Deep Learning ◽

Correlation Analysis ◽

Anomaly Detection ◽

Control Systems ◽

Industrial Control ◽

Industrial Control Systems

Download Full-text

SteelEye: An Application-Layer Attack Detection and Attribution Model in Industrial Control Systems using Semi-Deep Learning

10.1109/pst52912.2021.9647777 ◽

2021 ◽

Author(s):

Sanaz Nakhodchi ◽

Behrouz Zolfaghari ◽

Abbas Yazdinejad ◽

Ali Dehghantanha

Keyword(s):

Deep Learning ◽

Control Systems ◽

Attack Detection ◽

Application Layer ◽

Industrial Control ◽

Industrial Control Systems ◽

Detection And Attribution

Download Full-text

Industrial Anomaly Detection and Attack Classification Method Based on Convolutional Neural Network

Security and Communication Networks ◽

10.1155/2019/8124254 ◽

2019 ◽

Vol 2019 ◽

pp. 1-11 ◽

Cited By ~ 5

Author(s):

Yingxu Lai ◽

Jingwen Zhang ◽

Zenghui Liu

Keyword(s):

Neural Network ◽

Deep Learning ◽

Anomaly Detection ◽

Convolutional Neural Network ◽

Control Systems ◽

Mapping Method ◽

Learning Method ◽

Industrial Control ◽

Industrial Control Systems ◽

Scada System

The massive use of information technology has brought certain security risks to the industrial production process. In recent years, cyber-physical attacks against industrial control systems have occurred frequently. Anomaly detection technology is an essential technical means to ensure the safety of industrial control systems. Considering the shortcomings of traditional methods and to facilitate the timely analysis and location of anomalies, this study proposes a solution based on the deep learning method for industrial traffic anomaly detection and attack classification. We use a convolutional neural network deep learning representation model as the detection model. The original one-dimensional data are mapped using the feature mapping method to make them suitable for model processing. The deep learning method can automatically extract critical features and achieve accurate attack classification. We performed a model evaluation using real network attack data from a supervisory control and data acquisition (SCADA) system. The experimental results showed that the proposed method met the anomaly detection and attack classification needs of a SCADA system. The proposed method also promotes the application of deep learning methods in industrial anomaly detection.

Download Full-text

MADICS: A Methodology for Anomaly Detection in Industrial Control Systems

Symmetry ◽

10.3390/sym12101583 ◽

2020 ◽

Vol 12 (10) ◽

pp. 1583

Author(s):

Ángel Luis Perales Gómez ◽

Lorenzo Fernández Maimó ◽

Alberto Huertas Celdrán ◽

Félix J. García Clemente

Keyword(s):

Deep Learning ◽

Water Treatment ◽

Anomaly Detection ◽

Control Systems ◽

Learning Algorithms ◽

Treatment Plant ◽

Cyber Attacks ◽

Fine Tuning ◽

Industrial Control ◽

Industrial Control Systems

Industrial Control Systems (ICSs) are widely used in critical infrastructures to support the essential services of society. Therefore, their protection against terrorist activities, natural disasters, and cyber threats is critical. Diverse cyber attack detection systems have been proposed over the years, in which each proposal has applied different steps and methods. However, there is a significant gap in the literature regarding methodologies to detect cyber attacks in ICS scenarios. The lack of such methodologies prevents researchers from being able to accurately compare proposals and results. In this work, we present a Methodology for Anomaly Detection in Industrial Control Systems (MADICS) to detect cyber attacks in ICS scenarios, which is intended to provide a guideline for future works in the field. MADICS is based on a semi-supervised anomaly detection paradigm and makes use of deep learning algorithms to model ICS behaviors. It consists of five main steps, focused on pre-processing the dataset to be used with the machine learning and deep learning algorithms; performing feature filtering to remove those features that do not meet the requirements; feature extraction processes to obtain higher order features; selecting, fine-tuning, and training the most appropriate model; and validating the model performance. In order to validate MADICS, we used the popular Secure Water Treatment (SWaT) dataset, which was collected from a fully operational water treatment plant. The experiments demonstrate that, using MADICS, we can achieve a state-of-the-art precision of 0.984 (as well as a recall of 0.750 and F1-score of 0.851), which is above the average of other works, proving that the proposed methodology is suitable for use in real ICS scenarios.

Download Full-text