Efficient Cyber Attack Detection in Industrial Control Systems Using Lightweight Neural Networks and PCA

论文地址：Efficient Cyber Attack Detection in Industrial

摘要

Industrial control systems (ICSs) are widely used and vital to industry and society. Their failure can have severe impact on both the economy and human life. Hence, these systems have become an attractive target for physical and cyber attacks alike. In this paper, we examine an attack detection method based on simple and lightweight neural networks, namely, 1D convolutional neural networks and autoencoders. We apply these networks to both the time and frequency domains of the data and discuss the pros and cons of each representation approach.The suggested method is evaluated on three popular public datasets, and detection rates matching or exceeding previously published detection results are achieved, while demonstrating a small footprint, short training and detection times, and generality.We also show the effectiveness of PCA, which, given proper data preprocessing and feature selection, can provide high attack detection rates in many settings. Finally, we study the proposed method’s robustness against adversarial attacks that exploit inherent blind spots of neural networks to evade detection while achieving their intended physical effect. Our results show that the proposed method is robust to such evasion attacks: in order to evade detection, the attacker is forced to sacrififice the desired physical impact on the system.

Introduction

Industrial control systems (ICSs)又名supervisory control and data acquisition (SCADA) systems,很重要又很容易受攻击。随着remote connectivity的兴起，cyber threats越来越多。利用ML建模是一个比较通用的办法，目前有三种：supervised，semi-supervised，unsupervised。supervised贴标签费时又费力还有种种限制，semi-supervised和unsupervised方法被很多人研究。

但这些研究，有以下几个问题，第一，single dataset；第二，这些研究几乎没有解决过对输入数据进行正确的预处理和进行特征选择，有的选择了a subset of features,有的对不同特征有不同detection mechanism，缺乏统一的、系统的特征选择定量标准；第三，不通用，没有频域分析，没有考虑对抗攻击。

Problem Description

threat model：an attacker that can only falsify some of the information（伪造sensory data，给actuator发送指令，控制network traffic),并且这个attacker知道我们的attack detection（AD）的存在并且想逃避detection。

the following research questions：

Can we propose an effective and accurate ICS anomaly detection method based on lightweight neural networks or PCA? （基于lightweight neural networks or PCA）
Is the proposed method generic and effective across multiple environments and datasets?（通用性，多数据集，多环境）
What quantitative criteria should be used for anomaly detection feature selection?（quantitative criteria的选择）
Does detection in the frequency domain provide any benefifits (i.e., a better detection rate with fewer false alarms) compared to detection in the time domain?（frequency domain优于time domain）
How robust are the proposed NN architectures to adversarial machine learning attacks?（鲁棒性，对抗攻击）