Source-linked AI summary
Multivariate Industrial Time Series with Cyber-Attack Simulation: Fault Detection Using an LSTM-based Predictive Data Model
Pavel Filonov, Andrey Lavrentyev, Artem Vorontsov
TL;DR
Industrial cyber-physical systems need fault detection directly from multivariate process data, but real industrial datasets often lack anomalous examples. The paper evolves an LSTM forecasting-and-detection approach and validates it on a Modelica gasoil-plant dataset with injected attacks. LSTM achieves the best averaged F1 result on the described dataset, while a tunable error threshold supports adjustment of false-positive and false-negative rates.
Problem
Industrial cyber-physical systems require monitoring of technological-process data because conventional cybersecurity tools primarily detect malicious activity at communication and binary-execution levels.
Method
The paper trains an LSTM on normal multivariate industrial time series, forecasts the next batch, and detects faults when mean square prediction error exceeds a threshold.
Results
The LSTM achieves the best averaged F1 result for the described dataset and offers a tunable error threshold for balancing false-positive and false-negative detection rates.
Takeaways & Limitations
A publicly available dataset with sensor and control channels supports evaluation of LSTM-based industrial fault detection against classic methods.
Takeaways & Limitations
The approach produces only binary normal-versus-abnormal decisions, so alerts cannot be prioritized or interpreted and detected channels are not localized.
Abstract
from arXiv · showhide
We adopted an approach based on an LSTM neural network to monitor and detect faults in industrial multivariate time series data. To validate the approach we created a Modelica model of part of a real gasoil plant. By introducing hacks into the logic of the Modelica model, we were able to generate both the roots and causes of fault behavior in the plant. Having a self-consistent data set with labeled faults, we used an LSTM architecture with a forecasting error threshold to obtain precision and recall quality metrics. The dependency of the quality metric on the threshold level is considered. An appropriate mechanism such as "one handle" was introduced for filtering faults that are outside of the plant operator field of interest.
1. Introduction
The paper addresses fault detection in industrial cyber-physical processes, where conventional cybersecurity must be extended to monitor technological-process data. It evolves an LSTM-based approach and validates it with a self-consistent modeled dataset containing generated faults.
- Motivation: Industrial cyber-physical systems require process-data monitoring alongside communication- and binary-level cybersecurity tools.Deep package inspection is identified as a further requirement for protecting connected cyber-physical systems.
- Related work: Prior multivariate fault-detection approaches include statistical methods, support vector machines, segmentation, change-point detection, and LSTM models.The cited methods include PCA, DPCA, FDA, DFDA, CVA, PLS, SVM, and LSTM.
- Contribution: The paper evolves an LSTM-based approach for monitoring and detecting faults in multivariate industrial time series containing sensor and control signals.
- Validation dataset: A Modelica model of part of a real gasoil plant generates realistic normal and anomalous behavior for validation.Process logic was modified to generate faults in a self-consistent mathematical model.
- Validation dataset: The authors train and test an LSTM neural network using the model's causal variable relationships and investigate its results and architecture parameters.
2. Data Set Description
The authors build a Modelica gasoil-heating-loop dataset with multivariate process and control signals, then inject cyber attacks into process logic to produce labeled anomalous trajectories. The dataset captures fast, nonlinear industrial behavior for LSTM fault-detection experiments.
- Process model: The gasoil heating loop Modelica model represents receiving, heating, and collector tanks and heats gasoil in portions until the receiving tank reaches 60 °C.Heated portions circulate between the heating and receiving tanks before the receiving tank is emptied into the collector tank.
- Process model: Water replaces gasoil in the simplified model, which is simulated using Dymola.
- Generated dataset: The model generates 270-variable multivariate time series, while the paper presents experiments on 19 semantically selected variables.Applying the same technique to all 270 variables produced the same results with a fitting time 30% longer.
- Generated dataset: The selected signals include important process variables and gasoil-source and heater on/off control signals.The source and heater controls are the last two variables described in the selected series.
- Attack generation: Four cyber attacks alter the maximum receiving-tank level, maximum heating-tank temperature, pump frequency, or system relaxing-time set point.
- Attack generation: Experiments focus on maximum-receiving-tank-level attacks, varying attack time and hacked set-point value while training only on normal behavior.
- Dataset characteristics: Fault detection targets anomalous process flows as early as possible, including the point when a subprocess crosses normal-behavior conditions.
- Dataset characteristics: The generated data are high-dimensional, nonlinear, non-stationary, and non-Gaussian, with fast hacker-induced anomalies developing over roughly 100 seconds.The passage contrasts this anomaly timescale with about 10^6 seconds of data needed for complete parametric model learning.
3. LSTM-based Fault Detection
The approach forecasts the next batch of multivariate sensor and control signals with an LSTM, then detects faults when forecast error exceeds a threshold. Threshold selection and comparisons with conventional methods evaluate detection quality.
- Forecasting and detection: The algorithm splits the time series into batches, forecasts the next batch from observed batches, and compares measured and predicted values using MSE.Fault detection is based on whether the MSE exceeds a precomputed threshold.
- Data preprocessing: Normalization is applied separately to each dimension using its mean and standard deviation to reduce scale variation across signals.The data share a time grid but have significantly varying absolute values.
- Neural network architecture: The LSTM architecture is motivated by correlated, multiscale industrial processes for which conventional feed-forward networks perform poorly.The forecasting model uses a sequence-to-sequence LSTM architecture.
- Error processing: An exponential moving average smooths isolated high MSE values, with its half-life set to twice the batch length.The detection experiments use a subset of six selected process variables for improved MSE results.
- Thresholding and evaluation: A 0.999 empirical-error quantile provides the lower threshold bound; errors above the selected threshold are classified as abnormal behavior.Precision, recall, and F1 are evaluated across threshold levels, which can be tuned for a desired false-positive rate.
- Comparison with other methods: LSTM achieves the best averaged F1 result on the described dataset, while PCA, FDA, and VA show good precision but weaker recall.The comparison covers six selected variables and contrasts conventional fault-detection methods with the proposed approach.
4. Conclusion and Future Work
The paper presents a publicly available industrial fault-detection dataset and reports an LSTM-based approach with a tunable error threshold. Future work targets richer alert interpretation, channel localization, and more realistic process-model data.
- Conclusion: The paper presents a publicly available dataset for industrial fault detection, containing multivariate time-series training data and dozens of test sets with different fault types.The dataset includes sensor and control channels, including continuous and discrete channels.
- Conclusion: The LSTM-based fault-detection approach is reported to have advantages over classic fault-detection methods.
- Conclusion: The error threshold is a tunable parameter for achieving satisfactory false-positive and false-negative detection rates.
- Future Work: The current approach produces only a binary normal-versus-abnormal decision, so alerts cannot be prioritized or interpreted.The authors suggest adding an abnormality measure and fault-diagnosis methods as possible modifications.
- Future Work: Future fault-diagnosis methods could identify not only when a fault occurs but also the subset of channels where it is detected.This is particularly important for large-dimension time series.
- Future Work: The GHL model could be made more realistic by including stochastic parameters, measurement noise, and random outliers.The authors state that this would enrich process trajectories and support testing of low-order statistical parametric and change-point techniques.