Source-linked AI summary
Detecting Cyberattacks in Industrial Control Systems Using Convolutional Neural Networks
Moshe Kravchik, Asaf Shabtai
TL;DR
ICS anomaly detection needs alternatives to precise physical models and labeled attack data, which are difficult to obtain and may omit unknown attack classes. The paper evaluates unsupervised neural architectures using statistical prediction-error windows on SWaT, where a 1D CNN detected 32 of 36 attacks. Separate stage models performed better than a single whole-system model, while statelessness and unresolved inter-stage dependencies bound the approach.
Problem
ICS anomaly detection needs alternatives to precise physical models and labeled attack data, which are difficult to obtain and may omit unknown attack classes.
Method
The method predicts future feature values from prior sequences and flags windows whose prediction-error statistics exceed a threshold for the selected duration.
Results
32 out of 36 SWaT attacks were detected by the proposed 1D CNN, with superior runtime and performance reported by the authors.
Takeaways & Limitations
Separate models for individual process stages produced better results than one model for the whole system and scaled better for training.
Takeaways & Limitations
The 1D CNN is stateless beyond each sample sequence, and methods for learning inter-stage dependencies remain to be examined.
Abstract
from arXiv · showhide
This paper presents a study on detecting cyberattacks on industrial control systems (ICS) using unsupervised deep neural networks, specifically, convolutional neural networks. The study was performed on a SecureWater Treatment testbed (SWaT) dataset, which represents a scaled-down version of a real-world industrial water treatment plant. e suggest a method for anomaly detection based on measuring the statistical deviation of the predicted value from the observed value.We applied the proposed method by using a variety of deep neural networks architectures including different variants of convolutional and recurrent networks. The test dataset from SWaT included 36 different cyberattacks. The proposed method successfully detects the vast majority of the attacks with a low false positive rate thus improving on previous works based on this data set. The results of the study show that 1D convolutional networks can be successfully applied to anomaly detection in industrial control systems and outperform more complex recurrent networks while being much smaller and faster to train.
1 INTRODUCTION
ICS are increasingly exposed to cyberattacks as they adopt common IT technologies and remote connectivity. The paper studies unsupervised deep neural networks for physical-level anomaly detection, emphasizing 1D CNNs across SWaT process stages.
- ICS support vital sectors, but IT adoption and remote connectivity increase their exposure to cybersecurity vulnerabilities and incidents.Reported high-impact examples include attacks on a Ukrainian power plant, Iranian nuclear centrifuges, and Saudi oil infrastructure.
- Physical-level anomaly detection targets anomalous system behavior beyond network-level intrusion detection.The approach assumes attackers ultimately seek to influence the physical behavior of the system.
- Precise physical-process models are difficult to create, while supervised learning requires labeled normal and attack data that may omit unknown attack classes.These constraints motivate interest in unsupervised machine learning for ICS anomaly detection.
- The study extends unsupervised deep-neural-network research to cyberattack detection across all stages of the SWaT dataset.It evaluates different neural-network architectures rather than focusing on a single model.
- 1D CNNs detect multivariate ICS anomalies with few false positives by combining detection results from individual process stages.The paper also compares the efficiency of different neural-network architectures for ICS anomaly detection.
2 RELATED WORK
Prior ICS intrusion-detection research includes system modeling, network monitoring, and supervised, unsupervised, and semi-supervised learning. This paper positions 1D CNNs as an alternative physical-layer approach for multivariate time-series attack detection.
- System-modeling approaches require precise design knowledge and accurate representations of complex physical behavior.Maintaining such models can be practically difficult.
- Network-traffic intrusion detection monitors communications, whereas this work analyzes sensor and actuator data to focus on physical-layer system behavior.The distinction is illustrated using the SWaT dataset.
- Supervised methods require labeled malicious and normal behavior, which is difficult to acquire and highly system-dependent.Recent ICS research therefore commonly uses unsupervised or semi-supervised learning.
- The paper applies 1D CNNs to multivariate time series for multiple cyberattack instances in ICS data.It presents this as the first application of 1D CNNs to ICS cyberattack detection, to the authors’ knowledge.
- 1D CNNs demonstrate superior attack-detection abilities and higher F1 scores than previously published papers cited by the authors.Earlier 1D CNN work addressed faulty motor bearings using univariate motor-current data.
3 SECURE WATER TREATMENT (SWAT) TESTBED DATASET
SWaT is a scaled-down but fully operational water-treatment plant used to collect realistic ICS data. Its six-stage process includes sensors, actuators, PLCs, SCADA connectivity, normal recordings, and 36 attack scenarios.
- SWaT is a fully operational scaled-down water-treatment plant that produces purified water in a realistic complex ICS environment.The testbed was built by the Singapore University of Technology and Design for security research.
- The six-stage process uses sensors and actuators at stages P1–P6, with each stage connected to a PLC and the PLCs connected to SCADA.Sensors measure properties such as flow, level, conductivity, and pH; actuators include pumps and valves.
- Historian data were logged every second, with seven days of normal operation and four additional days during which 36 attacks were conducted.Recorded network traffic was available but not used in this work.
- Attacks altered Level 1 network traffic, spoofed sensor values, or issued fake SCADA commands.Scenarios targeted either a single process stage or multiple stages simultaneously.
4 BACKGROUND ON NEURAL NETWORKS
RNNs preserve information across time but can be difficult to train, while CNNs improve efficiency through local convolutions. The paper applies 1D CNNs to time-series locality in multivariate ICS data.
- 4.1 Recurrent Neural Networks: RNNs maintain state between inputs and selectively pass information based on internal state, unlike feed-forward networks that reset between samples.LSTM networks and truncated back-propagation through time address training difficulties associated with long sequences.
- 4.2 Convolutional Neural Networks: CNNs apply filters to small input regions instead of multiplying across the entire input at once, increasing neural-network efficiency.Traditional image-processing CNNs are generally two-dimensional.
- 4.2 Convolutional Neural Networks: 1D CNNs suit time-series processing because time series exhibit strong one-dimensional temporal locality.The paper applies this architecture to cyberattack detection in complex multivariate ICS data.
5 ANOMALY DETECTION METHOD
The method predicts future feature values, measures prediction error against observed statistics, and flags sustained multivariate deviations as anomalous windows. It evaluates attacks by whether detected windows overlap each attack period and its post-attack impact, while finding the statistical method better than CUSUM with fewer hyperparameters.
- Prediction-based anomaly detection: A neural network predicts future feature vectors from a preceding input sequence, producing predicted values for comparison with observations.The input is (x0,x1, . . . ,xn−1), and the output is (yn,yn+1, . . . ,yn+m).
- Prediction-based anomaly detection: The detector computes absolute prediction error for each feature and normalizes it using that feature’s mean and standard deviation, yielding an error z-score.This accounts for differences in how accurately individual features can be predicted.
- Thresholding and persistence: An anomaly state begins when the maximum feature z-score exceeds threshold T.The maximum is taken across all monitored features at each prediction time.
- Thresholding and persistence: The threshold must persist for at least time window W to reduce false alarms from irregularities and abrupt state changes such as pump switching.T and W are empirically determined hyperparameters; T defines the confidence level in the result.
- Attack-based evaluation: An attack is counted as detected when an anomalous window intersects the attack period or a constant post-attack extension, using attack-based scoring.The extension captures anomalous system behavior that can continue after the attack ends.
- Comparison with CUSUM: The statistical method outperformed the tested CUSUM approach and required only two hyperparameters instead of two per feature.CUSUM compares high and low cumulative sums with empirically defined upper and lower control limits.
6 EXPERIMENT AND ANALYSIS
The experiments evaluate unsupervised recurrent and convolutional neural-network architectures for predicting physical-layer ICS time series and detecting anomalies in SWaT data. Models generally learned accurate predictions, while 1D CNNs improved attack recall over prior work and varied substantially in training speed.
- Data and preprocessing: The study trained and tested models on SWaT sensor and actuator data, using normal and attack recordings from the physical process.The dataset included 496,800 normal records and 449,919 attack records covering 36 attacks; the first 16,000 training records were trimmed because the system was unstable.
- Data and preprocessing: Data enrichment concatenated engineered lag-difference features, which approximate feature derivatives at specified time lags.The researchers tested several augmentation techniques, but only this high-order feature enrichment increased detection score.
- Prediction setup: Sequence-to-vector prediction performed better than sequence-to-sequence prediction, and batches were extended to enable prediction of otherwise uncovered output values.The first points of a subsequent batch were appended to the preceding batch to address this coverage problem.
- Architectures: The evaluated architectures included basic, bidirectional, gated, and encoder-decoder recurrent networks alongside multiple 1D CNN variants.CNN configurations used one-dimensional convolutions along the time axis, with alternatives including batch normalization and feature-enrichment layers for interdependencies.
- Prediction accuracy: All neural-network configurations reached RMSE values of 0.02 or less after a small number of epochs when sufficient computational resources were available.At least two layers usually achieved this error level, while adding more layers did not greatly improve accuracy.
- Results and efficiency: LSTMs and inception-based convolution converged fastest and achieved the lowest training error, while other configurations reached similar results with more iterations.The study also reported average time per epoch for configurations with different model sizes and compared attack recall against previous work, finding improvement in almost all cases for 1D CNNs.
7 CONCLUSIONS AND FUTURE WORK
The study finds that unsupervised deep-learning anomaly detection, particularly 1D CNNs, can detect SWaT cyberattacks effectively, while dedicated stage models improve results and scalability. The authors identify limitations involving sequence modeling, dataset scope, attack simplicity, faulty-equipment detection, and cross-stage dependencies.
- Conclusions: 32 out of 36 attacks were detected by the proposed 1D CNN architecture, with superior runtime and performance reported for ICS cyberattack detection.The method uses a statistical window-based anomaly detector and was evaluated on the SWaT dataset.
- Limitations: The 1D CNN learns feature dependencies mainly in its final fully connected layer and cannot retain information beyond each sampled sequence.An early fully connected layer and first-derivative features were introduced; second derivatives and other methods produced no additional improvement.
- Conclusions: Dedicated models for each process stage produced better results than a single model for the whole system.Separate stage models may scale better, although methods for learning inter-stage dependencies remain to be examined.
- Limitations: Validity is limited by evaluation on one dataset from one industrial-process type and by relatively simple attacks spoofing only a small subset of features.The authors also state that the study made no assumptions about the modeled system or its attacks.
- Future work: The method was designed for cyberattack detection, so its ability to detect faulty-equipment behavior remains to be tested.Faulty equipment is identified as another form of anomalous ICS behavior.
- Future work: Future work includes learning cross-stage features, embedding higher-order process models, supporting streaming data, improving interpretability, and detecting faulty ICS equipment behavior.The proposed directions extend both the modeling approach and its deployment scope.