Intrusion detection problem in Industrial Control Systems(ICS), such as water treat- ment plant and power grid, is an important real-world problem. Real-time anomaly detection have been proposed to minimize the risk of cyber attack. In this study, two different kind of intrusion
...
Intrusion detection problem in Industrial Control Systems(ICS), such as water treat- ment plant and power grid, is an important real-world problem. Real-time anomaly detection have been proposed to minimize the risk of cyber attack. In this study, two different kind of intrusion detection mode-based approach are learned from normal behaviour of an ICS, SWaT. One model is inspired by TABOR, a offline graphical model-based approach of CPS intrusion detection. Timed automaton, Bayesian net- work and Out of Alphabet are combined to find anomalies and localize the abnormal sensors and actuators. The other model proposed is based on two time slice Bayesian Network(2-TBN) with the motivation simplifying multi-model approach into a single model one. In this way, cost of computing power and time is reduced in order to meet the requirement of real-time operation testing.
Experimental results demonstrate the model’s close performance to TABOR and slight advantage on time. The study about difference between offline testing and real-time operation is another topic in this study. The generic underlying idea and experience is also applicable to cyber physical system in other industrial control systems.