Anomaly Detection for Industrial Control System Based on Autoencoder Neural Network

As the Industrial Internet of Things (IIoT) develops rapidly, cloud computing and fog computing become effective measures to solve some problems, e.g., limited computing resources and increased network latency. The Industrial Control Systems (ICS) play a key factor within the development of IIoT, whose security affects the whole IIoT. ICS involves many aspects, like water supply systems and electric utilities, which are closely related to people’s lives. ICS is connected to the Internet and exposed in the cyberspace instead of isolating with the outside recent years. The risk of being attacked increases as a result. In order to protect these assets, intrusion detection systems (IDS) have drawn much attention. As one kind of intrusion detection, anomaly detection provides the ability to detect unknown attacks compared with signature-based techniques, which are another kind of IDS. In this paper, an anomaly detection method with a composite autoencoder model learning the normal pattern is proposed. Unlike the common autoencoder neural network that predicts or reconstructs data separately, our model makes prediction and reconstruction on input data at the same time, which overcomes the shortcoming of using each one alone. With the error obtained by the model, a change ratio is put forward to locate the most suspicious devices that may be under attack. In the last part, we verify the performance of our method by conducting experiments on the SWaT dataset. The results show that the proposed method exhibits improved performance with 88.5% recall and 87.0% F1-score.

Download Full-text

Intrusion Detection for Industrial Control Systems Based on Open Set Artificial Neural Network

Security and Communication Networks ◽

10.1155/2021/4027900 ◽

2021 ◽

Vol 2021 ◽

pp. 1-14

Author(s):

Chao Wang ◽

Bailing Wang ◽

Yunxiao Sun ◽

Yuliang Wei ◽

Kai Wang ◽

...

Keyword(s):

Neural Network ◽

Artificial Neural Network ◽

Intrusion Detection ◽

Control Systems ◽

Industrial Control ◽

Industrial Control Systems ◽

Open Set ◽

The Neural Network ◽

Center Loss ◽

Artificial Neural

The security of industrial control systems (ICSs) has received a lot of attention in recent years. ICSs were once closed networks. But with the development of IT technologies, ICSs have become connected to the Internet, increasing the potential of cyberattacks. Because ICSs are so tightly linked to human lives, any harm to them could have disastrous implications. As a technique of providing protection, many intrusion detection system (IDS) studies have been conducted. However, because of the complicated network environment and rising means of attack, it is difficult to cover all attack classes, most of the existing classification techniques are hard to deploy in a real environment since they cannot deal with the open set problem. We propose a novel artificial neural network based-methodology to solve this problem. Our suggested method can classify known classes while also detecting unknown classes. We conduct research from two points of view. On the one hand, we use the openmax layer instead of the traditional softmax layer. Openmax overcomes the limitations of softmax, allowing neural networks to detect unknown attack classes. During training, on the other hand, a new loss function termed center loss is implemented to improve detection ability. The neural network model learns better feature representations with the combined supervision of center loss and softmax loss. We evaluate the neural network on NF-BoT-IoT-v2 and Gas Pipeline datasets. The experiments show our proposed method is comparable with the state-of-the-art algorithm in terms of detecting unknown classes. But our method has a better overall classification performance.

Download Full-text

Industrial Anomaly Detection and Attack Classification Method Based on Convolutional Neural Network

Security and Communication Networks ◽

10.1155/2019/8124254 ◽

2019 ◽

Vol 2019 ◽

pp. 1-11 ◽

Cited By ~ 5

Author(s):

Yingxu Lai ◽

Jingwen Zhang ◽

Zenghui Liu

Keyword(s):

Neural Network ◽

Deep Learning ◽

Anomaly Detection ◽

Convolutional Neural Network ◽

Control Systems ◽

Mapping Method ◽

Learning Method ◽

Industrial Control ◽

Industrial Control Systems ◽

Scada System

The massive use of information technology has brought certain security risks to the industrial production process. In recent years, cyber-physical attacks against industrial control systems have occurred frequently. Anomaly detection technology is an essential technical means to ensure the safety of industrial control systems. Considering the shortcomings of traditional methods and to facilitate the timely analysis and location of anomalies, this study proposes a solution based on the deep learning method for industrial traffic anomaly detection and attack classification. We use a convolutional neural network deep learning representation model as the detection model. The original one-dimensional data are mapped using the feature mapping method to make them suitable for model processing. The deep learning method can automatically extract critical features and achieve accurate attack classification. We performed a model evaluation using real network attack data from a supervisory control and data acquisition (SCADA) system. The experimental results showed that the proposed method met the anomaly detection and attack classification needs of a SCADA system. The proposed method also promotes the application of deep learning methods in industrial anomaly detection.

Download Full-text