Discovering a data interpreted petri net model of industrial control systems for anomaly detection

Abstract

An industrial control system (ICS) can be described as an integration of heterogeneous processes, i.e., a discrete event-driven process at the automatic control layer and a continuous time-driven process at the physical layer. To accurately describe the behaviour of an ICS, a model must capture the characteristics of both the discrete and continuous processes and their interactions. We present a method to discover a data-interpreted Petri net (DIPN) model of an ICS from the observed input/output signals of the controller. A DIPN model combines a Petri net and differential equations which are typically used for modelling discrete event-driven processes and continuous time driven processes. Hence, the main contribution of our paper is to discover guards on event transitions which serve as the link between the discrete automatic control layer and the continuous physical layer processes of an ICS. Supporting this, we rely on existing system identification methods to discover models of discrete and continuous processes, i.e., Petri nets and differential equations.Model discovery is useful for wide range of applications such as reverse engineering, performance optimisation, and anomaly detection. This paper is motivated by the problem of discovering a model of an industrial control system for anomaly detection. Unlike black-box model discovery methods such as neural networks, the goal of our work for practical application is to discover a human readable model which it can provide actionable reports of anomaly detection. To assess the accuracy of the discovered DIPN model, it was used as a binary classifier to detect anomalies in a publicly available dataset of a water treatment plant.