1. Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems
- Author
-
Weijie Hao, Qiang Yang, and Yang Tao
- Subjects
Computational complexity theory ,Control and Systems Engineering ,Computer science ,Distributed computing ,Scalability ,Testbed ,Cyber-physical system ,Anomaly detection ,Industrial control system ,Electrical and Electronic Engineering ,Communications system ,Communications protocol - Abstract
Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber-physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity.
- Published
- 2023
- Full Text
- View/download PDF