A Novel Approach for Detecting and Analyzing Cyber-Attacks in Cyber-Physical Systems
摘要
With the rapid development of industry, we are currently experiencing the fourth industrial revolution. Many products, equipment, and sensors are connected to the internet. Although this gives us greater access to data, it opens up opportunities for hackers to access the system, and the cause for system anomaly becomes extremely complicated. However, computer systems have grown in complexity to the point where manual detection of anomalies in the system has become impracticable, and machine-led analysis must be relied upon. To more accurately discriminate the cause of the abnormality, we propose a new method based on detecting log anomalies, which is to judge whether the system has been attacked by cyber-attacks through the sequence of occurrences of cyber data and physical phenomena. In this paper, we use Autoencoder (AE) and Bidirectional Long Short Term Memory (Bi-LSTM) to discriminate sources of disturbance. Our proposed solution, “Result explainable Neural Network” (RxNN), outputs an anomaly score for each log event. This score expresses the contextual relevance of cyber data and physical phenomena. The experimental results show that the proposed solution is more accurate and effective in anomalies in the log than other neural network models.