Industrial Intrusion Detection Research Articles

A New Industrial Intrusion Detection Method Based on CNN-BiLSTM

A New Industrial Intrusion Detection Method Based on CNN-BiLSTM

Causal Inference-Based Adversarial Domain Adaptation for Cross-Domain Industrial Intrusion Detection

Causal Inference-Based Adversarial Domain Adaptation for Cross-Domain Industrial Intrusion Detection

An Industrial Intrusion Detection Method Based on Hybrid Convolutional Neural Networks with Improved TCN

An Industrial Intrusion Detection Method Based on Hybrid Convolutional Neural Networks with Improved TCN

SoK] Evaluations in Industrial Intrusion Detection Research

SoK] Evaluations in Industrial Intrusion Detection Research

Cross-Domain Industrial Intrusion Detection Deep Model Trained With Imbalanced Data

Constrained by the high acquisition and labeling cost, traffic data in industrial control systems (ICSs) are usually extremely imbalanced. Deep-learning-based (DL) industrial control intrusion detection systems (IDSs) are not applicable to dynamic networks and show a limited detection performance. In this article, we enhanced the information transmission link in adversarial domain adaptation (DA) and proposed an information-enhanced adversarial DA (IADA) method. Our method could train a cross-domain industrial intrusion detection deep model with imbalanced data and maintained high detection accuracy. The experimental results based on SCADA network layer data showed that the detection accuracy of the gated recurrent unit model trained in IADA reached 93.7% and 91.3% in the two transfer tasks with a significant cross-domain discrepancy.

Stacked One-Class Broad Learning System for Intrusion Detection in Industry 4.0

With the vigorous development of Industry 4.0, industrial Big Data has turned into the core element of the Industrial Internet of Things. As one of the most fundamental and indispensable components in industrial cyber-physical systems (CPS), intelligent anomaly detection is still an essential and challenging issue. However, with the development of the network, there may exist unknown types of attacks, which are difficult to collect. Facing one-class industrial intrusion detection scenario that the collected training data only includes normal state, the one-class broad learning system (OCBLS) and the stacked OCBLS (ST-OCBLS) algorithms are developed. Benefiting from the characteristics of BLS, our proposed approaches retain the advantage of efficient training process. Moreover, the high-level hidden features of the network traffic data can be learned through the progressive encoding and decoding mechanism in ST-OCBLS. Extensive comparative experiments on several real-world intrusion detection tasks are carried out to demonstrate that our proposed methods have competitive performance and high efficiency in the face of complex network data and diversified types of intrusions. Overall, this article provides a new alternative solution for network intrusion detection in Industry 4.0.

Advanced Intrusion Detection System for Industrial Cyber-Physical Systems

Cyber-Physical Systems are complex systems that integrate physical processes and communication networks like critical infrastructures and industrial plants. Unfortunately, the integration of physical and cyber layers causes also possible issues such as the increased surface of cyber-attacks. A possible example of CPS is the industrial world, which is one of the most important targets of cyber-attacks. Applying protecting architecture as the ones developed for the IT world is not possible due to the specific features of the industrial environment. However, the paper exploits the features of the industrial communication networks to develop an industrial intrusion detection system named Smart Security Probe. This solution has been designed to detect possible anomalies in the network traffic and to help to infer possible anomalies in the data related to the physical processes. S2P has been tested and validated in an environment made of two Programmable Logic Controllers and two Supervisory Control and Data Acquisition systems that are controlling four simulated tanks. The anomaly detection is based on a couple of Interlaced Extended Kalman Filters that are distributed among the controllers and exchange data securely through the Smart Security Probe. The results demonstrate the feasibility of the proposed solution.

Industrial intrusion detection based on the behavior of rotating machine

In this study, a new industrial intrusion detection method is introduced for the control system of rotating machines as critical assets in many industries. Data tampering is a major attack on the control systems which disrupts the functionality of the asset. Hence, our objective is to detect data manipulations in the system. We use the behavior of the rotating machine to propose new industrial intrusion detection for the control system of the rotating machine by machine learning techniques. The behavior is elicited by the data of sensors under all the conditions of the rotating machine operation. In this work, the nonlinear regression, novelty detection, outlier detection, and classification approaches are implemented to create behavioral model. On each implementation, online data are compared with the real data of behavior prediction model during the operation of the rotating machine to detect any abnormality. According to our experimental results, the accuracy of the behavioral models created by the One-classSVM novelty detection, k- Nearest Neighbor (kNN) outlier detection, decision tree classifier, k-Neighbors classifier, random forest classifier, and AdaBoost classifier is obtained as 0.98, 0.994, 0.999, 0.999, 0.999, and 0.999, respectively. The results indicate that the proposed industrial intrusion detection method is able to detect the data tampering attacks on the control system of the rotating machines very accurately.

Deep Learning Anomaly Detection Based on Hierarchical Status-Connection Features in Networked Control Systems

As networked control systems continue to be widely used in large-scale industrial productions, industrial cyber-attacks have become an inevitable problem that can cause serious damage to critical infrastructures. In practice, industrial intrusion detection has been widely acknowledged to detect abnormal communication behaviors. However, unlike traditional IT systems, networked control systems have their own communication characteristics due to specific industrial communication protocols. Thus, simple cyber-attack modeling is inadequate and impractical for high-efficiency intrusion detection because the characteristics of network control systems are less considered. Based on the status information and transmission connection in industrial communication data payloads, which can properly express the characteristics of industrial control logic, this paper associates industrial communication features with transmission connection payload and status payload. Furthermore, transmission connection features include device address, context, time, and packet length, while status features cover measurement, input, distributed state, control state, and more. After designing a convolutional neural network (CNN) and a long short-term memory network (LSTM) to extract status features and transmission connection features from industrial communication data, this paper proposes a hierarchical deep learning anomaly detection approach, which can integrate the advantages of CNN and LSTM to achieve high-efficiency detection. The experimental results clearly show that the proposed approach, having the advantages of strong detection capability and low false alarm rate, is a superior means of anomaly detection when compared to its peers.

APT attack detection algorithm based on spatio-temporal association analysis in industrial network

The advanced persistent threat (APT) is the foremost threat to industrial network security today, and traditional feature detection based industrial intrusion detection systems arc often unable to detect the latest APT attacks. Existing researchers believe that theft of sensitive data is one of the important goals of APT attacks. In order to accurately identify the stealing behavior of the APT attack, a spatio-temporal association analysis is proposed to detect the APT attack in industrial network, which includes association rules mining, historical data retrieval and feature classification. Firstly, FP-Growth Algorithm on APT attack’s temporal features, spatial features and category features is adopted to mine the association rules. And then, the relation between APT attack’s features is analyzed, and the rules are explained semantically in combination with the features of APT attack historical data retrieval method based on Bloom filter algorithm. Finally, a multi-feature spatial weighted combined SVM classification detection algorithm which is used to detect abnormal APT attack session flows. Experiments show that our proposed algorithm has a good ability to detect hidden APT attacks, and the multi-feature spatial weighted combined SVM classification detection algorithm has higher detection accuracy and lower false alarm rate than traditional single classification detection, and it is also safe for industrial control security. In addition, our proposed algorithm uses less space and could judge whether the data is in the current data set rapidly.

A novel intrusion detection system based on an optimal hybrid kernel extreme learning machine

Intrusion detection is a challenging technology in the area of cyberspace security for protecting a system from malicious attacks. A novel accurate and effective misuse intrusion detection system that relies on specific attack signatures to distinguish between normal and malicious activities is therefore presented to detect various attacks based on an extreme learning machine with a hybrid kernel function (HKELM). First, the derivation and proof of the proposed hybrid kernel are given. A combination of the gravitational search algorithm (GSA) and differential evolution (DE) algorithm is employed to optimize the parameters of HKELM, which improves its global and local optimization abilities during prediction attacks. In addition, the kernel principal component analysis (KPCA) algorithm is introduced for dimensionality reduction and feature extraction of the intrusion detection data. Then, a novel intrusion detection approach, KPCA-DEGSA-HKELM, is obtained. The proposed approach is eventually applied to the classic benchmark KDD99 dataset, the real modern UNSW-NB15 dataset and the industrial intrusion detection dataset from the Tennessee Eastman process. The numerical results validate both the high accuracy and the time-saving benefit of the proposed approach.

Detecting cyberattacks in industrial control systems using online learning algorithms

Industrial control systems are critical to the operation of industrial facilities, especially for critical infrastructures, such as refineries, power grids, and transportation systems. Similar to other information systems, a significant threat to industrial control systems is the attack from cyberspace—the offensive maneuvers launched by “anonymous” in the digital world that target computer-based assets with the goal of compromising a system’s functions or probing for information. Owing to the importance of industrial control systems, and the possibly devastating consequences of being attacked, significant endeavors have been attempted to secure industrial control systems from cyberattacks. Among them are intrusion detection systems that serve as the first line of defense by monitoring and reporting potentially malicious activities. Classical machine-learning-based intrusion detection methods usually generate prediction models by learning modest-sized training samples all at once. Such approach is not always applicable to industrial control systems, as industrial control systems must process continuous control commands with limited computational resources in a nonstop way. To satisfy such requirements, we propose using online learning to learn prediction models from the controlling data stream. We introduce several state-of-the-art online learning algorithms categorically, and illustrate their efficacies on two typically used testbeds—power system and gas pipeline. Further, we explore a new cost-sensitive online learning algorithm to solve the class-imbalance problem that is pervasive in industrial intrusion detection systems. Our experimental results indicate that the proposed algorithm can achieve an overall improvement in the detection rate of cyberattacks in industrial control systems.

SIDS: State-based intrusion detection for stage-based cyber physical systems

Attacks to Cyber Physical Systems (CPSs) are detected by Industrial Intrusion Detection Systems (IIDSs). Operation of stage-based CPSs (those for which their underlying process is batch) consists of three parts: normal states, normal transitions between the normal states, and normal time-intervals for transitions. Unfortunately, state-of-the-art IIDSs directly address cyber-attacks that result in anomalous states whereas anomalous transitions or time-intervals can also indicate cyber-attacks. In this paper, a State-based IDS (SIDS) is proposed to detect all three anomalies. For doing this, SIDS first automatically extracts the normal behavior of CPS. Then it monitors current CPS behavior and detects intrusions by directly looking at the data of field layer. A small-scale but real CPS (a mixer process) is provided to illustrate how SIDS works. In addition, experimental results on three cyber-attacks orchestrated on a simulated milk pasteurization process indicate that SIDS can successfully detect cyber-attacks to large I/O CPSs.

SysDetect: A systematic approach to critical state determination for Industrial Intrusion Detection Systems using Apriori algorithm

In recent years, Industrial Intrusion Detection Systems (IIDSs) are employed to improve the security of CPS. Among the state-of-the-art IIDSs, state based intrusion detection is a widely used approach. In such process aware IIDSs, normal states are extracted from historical process data or directly specified by control experts when the historical data is not (or rarely) available. In the second manner, experts try to determine the critical states of the process. However, having a large number of I/O, investigating all process states for determination of critical states is not practical. In this paper, the problem is resolved by proposing SysDetect (a Systematic approach to Critical State Determination) which employs a well-established and iterative data mining algorithm, i.e. Apriori. SysDetect guarantees that all candidate critical states are generated at each iteration. In addition, by identifying the critical states at each iteration using experts’ opinions, number of generated candidates in the next iteration is significantly reduced. As a result, SysDetect in addition to provide a complete solution, guarantees that no redundant candidate is generated. Experimental results on a real settings indicate that SysDetect can be successfully applied to determine the critical states of industrial processes using experts’ opinions.