Industrial Control Systems (ICS) are complex networks that coordinate critical infrastructures, such as electricity, gas, water, and transportation. Initially, ICS were isolated from the Internet. However, with advancements in Internet technology and a growing need for data sharing with other systems, Internet connectivity has become essential. This increased connectivity, combined with various industrial protocols, has led to more frequent and complex cyber-attacks on ICS. Such attacks can disrupt digital systems and may even cause failures in physical equipment, resulting in cyber-physical attacks. The goal of this study is to propose a hybrid approach to anomaly detection using deep learning approaches, evaluated through Root Mean Square Error (RMSE), Mean Square Error (MSE), and Mean Absolute Error (MAE) metrics for regression problems. Statistical methods were employed to determine anomaly thresholds, with model performance assessed via precision and recall. The combined LSTM + GRU and Bi-LSTM + Bi-GRU models demonstrated lower RMSE, MSE, and MAE. Tested on the Secure Water Treatment (SWaT) dataset, the combined model detected 35 out of 36 attacks, outperforming individual models (LSTM: 33, GRU: 34). This research enhances model performance through deep learning integration, hyperparameter tuning, and point anomaly detection in the ICS domain.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Anomaly Detection for the Industrial Control Systems: A Hybrid Deep Learning Approach

  • Meseret Wodaje Tebeje,
  • Yirga Yayeh Munaye,
  • Ermiyas Birihanu

摘要

Industrial Control Systems (ICS) are complex networks that coordinate critical infrastructures, such as electricity, gas, water, and transportation. Initially, ICS were isolated from the Internet. However, with advancements in Internet technology and a growing need for data sharing with other systems, Internet connectivity has become essential. This increased connectivity, combined with various industrial protocols, has led to more frequent and complex cyber-attacks on ICS. Such attacks can disrupt digital systems and may even cause failures in physical equipment, resulting in cyber-physical attacks. The goal of this study is to propose a hybrid approach to anomaly detection using deep learning approaches, evaluated through Root Mean Square Error (RMSE), Mean Square Error (MSE), and Mean Absolute Error (MAE) metrics for regression problems. Statistical methods were employed to determine anomaly thresholds, with model performance assessed via precision and recall. The combined LSTM + GRU and Bi-LSTM + Bi-GRU models demonstrated lower RMSE, MSE, and MAE. Tested on the Secure Water Treatment (SWaT) dataset, the combined model detected 35 out of 36 attacks, outperforming individual models (LSTM: 33, GRU: 34). This research enhances model performance through deep learning integration, hyperparameter tuning, and point anomaly detection in the ICS domain.