GRU-based Buzzer Ensemble for Abnormal Detection in Industrial Control燬ystems
Source abstract
Abstract
Recently, Industrial Control Systems (ICSs) have been changing from a closed environment to an open environment because of the expansion of digital transformation, smart factories, and Industrial Internet of Things (IIoT). Since security accidents that occur in ICSs can cause national confusion and human casualties, research on detecting abnormalities by using normal operation data learning is being actively conducted. The single technique proposed by existing studies does not detect abnormalities well or provide satisfactory results. In this paper, we propose a GRU-based Buzzer Ensemble for Abnormal Detection (GBE-AD) model for detecting anomalies in industrial control systems to ensure rapid response and process availability. The newly proposed ensemble model of the buzzer method resolves False Negatives (FNs) by complementing the limited range that can be detected in a single model because of the internal models composing GBE-AD. Because the internal models remain suppressed for False Positives (FPs), GBE-AD provides better generalization. In addition, we generated mean prediction error data in GBE-AD and inferred abnormal processes using soft and hard clustering. We confirmed that the detection model's Time-series Aware Precision (TaP) suppressed FPs at 97.67%. The final performance was 94.04% in an experiment using an HIL-based Augmented ICS (HAI) Security Dataset (ver.21.03) among public datasets.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Anomaly Detection Techniques and Applications · Network Security and Intrusion Detection · Smart Grid Security and Resilience
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (25)
Show source-provided references
1. Whitelist-based anomaly detection for industrial control system security10.7840/kics.2013.38B.8.641 ↗
2. Model verification and exhaustive testing for whitelist function of industrial control system
3. PLC protection system based on verification separation,”10.32604/cmc.2022.021020 ↗
4. Deep learning based intelligent industrial fault diagnosis model10.32604/cmc.2022.021716 ↗
5. Anomaly detection in cyber physical systems using recurrent neural networks
6. Detecting cyber attacks in industrial control systems using convolutional neural networks
7. D. Li, D. Chen, J. Goh and S. -K. Ng, “Anomaly detection with generative adversarial networks for multivariate time series,” arXiv preprint arXiv:1809.04758v3, 2019.
8. J. Kim, J. -H. Yun and H. -C. Kim, “Anomaly detection for industrial control systems using sequence-to-sequence neural networks,” arXiv preprint arXiv:1911.04831, 2019.10.1007/978-3-030-42048-2_1 ↗
9. Detecting anomalies in time-series data using unsupervised learning and analysis on infrequent signatures
10. An ensemble deep learning-based cyber-attack detection in industrial control system10.1109/ACCESS.2020.2992249 ↗
11. Stacked-autoencoder based anomaly detection with industrial control system10.1007/978-3-030-67008-5_15 ↗
12. Kim · ICT Systems Security and Privacy Protection. SEC 2021. IFIP Advances in Information and Communication Technology · 2021 · 625 · 382
13. Intrusion detection for industrial control systems based on open set artificial neural network10.1155/2021/8690662 ↗
14. Learning phrase representations using rnn encoder-decoder for statistical machine translation
15. HAI 1.0: HIL-based augmented ICS security dataset
16. Two ICS security datasets and anomaly detection contest on the HIL-based augmented ICS testbed
17. The purdue enterprise reference architecture10.1016/0166-3615(94)90017-5 ↗
18. Deep learning-based anomaly detection in cyber-physical systems: Progress and opportunities10.1145/3453155 ↗
19. Towards open set deep networks
20. Secure Water Treatment (SWaT), October 2021. [Online]. Available: http://itrust.sutd.edu.sg/research/testbeds/secure-water-treatment-swat/.
21. Industrial Control System (ICS) Cyber Attack Datasets, October 2021. [Online]. Available: https://sites.google.com/a/uah.edu/tommy-morris-uah/ics-data-sets.
22. M. Sarhan, S. Layeghy, N. Moustafa and M. Portmann, “Towards a standard feature set of NIDS datasets,” https://arxiv.org/abs/2101.11315v2, 2021.
23. Abnormal detection for industrial control systems using ensemble recurrent neural networks model
24. Precision and recall for time series
25. Time-series aware precision and recall for anomaly detection: Considering variety of detection result and addressing ambiguous labeling