Anomaly Detection for Industrial Control Systems Based on Neural Networks with One-Class Objective Function

Abstract

The advent of Internet of Things (IoT) technologies and the prevalence of networked sensors and actuators in many industrial control systems (ICS) have led to the exposure of critical infrastructure in our society to malicious activities and cyber threats. ICS are used to monitor and control critical infrastructure in our society that provide essential services such as electricity, water supply, among others. Programmable logic controllers (PLCs) are embedded devices that automate the processes of industrial control systems. PLCs which serve as the heart of ICS are vulnerable to attacks just like other embedder devices. Because PLCs are widely used to control the physical processes of ICS, attacks against PLCs can cause irreparable damages to enterprises and even loss of lives. However, due to the unique and proprietary architecture of PLCs, it is not easy to apply traditional tools and techniques for PLC protection. In this work, we present a novel unsupervised learning approach for anomaly detection in ICS based on neural networks with one class objective function. This technique combines the abilities of neural networks to learn complex relationships with a one class objective function for separating normal conditions from anomalous operations. We evaluated our model on a recent dataset collected from a real-world ICS: the Secure Water Treatment (SWaT) dataset. The performance of our proposed technique is compared with previous works, and it shows improvements in terms of scalability and attack detection capability, proving that the proposed technique is suitable for use in real ICS scenario.