A Dual-Isolation-Forests-Based Attack Detection Framework for Industrial Control Systems

Mariam Elnour,Khaled Khan,Nader Meskin,Raj Jain

doi:10.1109/access.2020.2975066

Abstract

The cybersecurity of industrial control systems (ICSs) is becoming increasingly critical under the current advancement in the cyber activity and the Internet of Things (IoT) technologies, and their direct impact on several life aspects such as safety, economy, and security. This paper presents a novel semi-supervised dual isolation forests-based (DIF) attack detection system that has been developed using the normal process operation data only and is demonstrated on a scale-down ICS known as the Secure Water Treatment (SWaT) testbed and the Water Distribution (WADI) testbed. The proposed cyber-attack detection framework is composed of two isolation forest models that are trained independently using the normalized raw data and a pre-processed version of the data using Principal Component Analysis (PCA), respectively, to detect attacks by separating-away anomalies. The performance of the proposed method is compared with the previous works, and it demonstrates improvements in terms of the attack detection capability, computational requirements, and applicability to high dimensional systems.

Highlights

Industrial control systems (ICSs) are composed of electrical and mechanical devices, computers, and manual operations supervised by humans
The working principle of the proposed approach is identifying and separating away anomalies from the normal observations using the concept of isolation after analyzing the data in the original and the Principal Component Analysis (PCA)-transformed representations
The dual isolation forests-based (DIF)-based attack detection framework was compared with other approaches in terms of precision, recall, and F1-score

Summary

Introduction

Industrial control systems (ICSs) are composed of electrical and mechanical devices, computers, and manual operations supervised by humans. They are mainly used for partial or full automation control in industrial plants and critical infrastructures such as manufacturing industries, chemical plants, power generation and distribution systems, water treatment plants, and others [1]. Their operation has a direct impact on the environment, the safety and health of people, the economy, and national security. There have been a number of cyber-attacks on critical infrastructures in the past few years [2]–[4], and research in cybersecurity of industrial control systems has been evolving

Methods

Results

Conclusion