Adversarial Attacks on Machine Learning Cybersecurity Defences in Industrial Control Systems

Eirini Anthi; Lowri Williams; Matilda Rhode; Pete Burnap; Adam Wedgbury

Source-linked AI summary

Adversarial Attacks on Machine Learning Cybersecurity Defences in Industrial Control Systems

Eirini Anthi, Lowri Williams, Matilda Rhode, Pete Burnap, Adam Wedgbury

arXiv:2004.05005v1Apr 10, 2020cs.LGcs.CReess.SPstat.ML

TL;DR

Machine-learning IDSs improve automated ICS attack detection but introduce models that AML may exploit to bypass detection. The paper generates JSMA adversarial samples from an authentic power-system dataset, evaluates Random Forest and J48, and tests adversarial training. Both classifiers lost performance under attack, while adversarial training improved robustness, with Random Forest showing the greater increase.

Problem
AML can exploit machine-learning IDSs by perturbing malicious data so it is classified as benign, potentially bypassing ICS attack detection.
Method
The study generates adversarial samples with the Jacobian-based Saliency Map method and evaluates supervised classifiers before and after adversarial training on an authentic power-system dataset.
Results
Classification performance decreased by 16 and 20 percentage points for Random Forest and J48, respectively, when adversarial samples were present.
Takeaways & Limitations
Adversarial training improved performance on unseen adversarial samples, with Random Forest reporting a greater increase than J48 on the given dataset.

Abstract

from arXiv · show

The proliferation and application of machine learning based Intrusion Detection Systems (IDS) have allowed for more flexibility and efficiency in the automated detection of cyber attacks in Industrial Control Systems (ICS). However, the introduction of such IDSs has also created an additional attack vector; the learning models may also be subject to cyber attacks, otherwise referred to as Adversarial Machine Learning (AML). Such attacks may have severe consequences in ICS systems, as adversaries could potentially bypass the IDS. This could lead to delayed attack detection which may result in infrastructure damages, financial loss, and even loss of life. This paper explores how adversarial learning can be used to target supervised models by generating adversarial samples using the Jacobian-based Saliency Map attack and exploring classification behaviours. The analysis also includes the exploration of how such samples can support the robustness of supervised models using adversarial training. An authentic power system dataset was used to support the experiments presented herein. Overall, the classification performance of two widely used classifiers, Random Forest and J48, decreased by 16 and 20 percentage points when adversarial samples were present. Their performances improved following adversarial training, demonstrating their robustness towards such attacks.

I. INTRODUCTION

ICS increasingly use machine-learning IDSs, but AML can exploit model blind spots to misclassify malicious data and potentially bypass detection. This study empirically examines supervised-model behaviour on adversarial samples and investigates adversarial training as a robustness measure.

Motivation: ICS support critical infrastructure, but increasing interconnection and remote access have expanded their exposure to cyber attacks.ICS are used in manufacturing, power grids, water treatment, refineries, and health care.
Motivation: Resource constraints and legacy devices make traditional security mechanisms difficult to integrate into ICS, motivating complementary monitoring-based IDSs.Passive process-data monitoring is identified as a promising complementary solution.
Threat model: AML exploits model blind spots by perturbing unseen data so samples cross decision boundaries and receive incorrect classifications.In ICS, manipulated malicious data may be classified as benign, potentially bypassing the IDS and delaying detection.
Study aims: The study empirically investigates supervised-model behaviour against adversarial samples and the use of adversarial training to improve robustness.It uses a representative power-system dataset and generates adversarial samples with the Jacobian-based Saliency Map method.

II. RELATED WORK

Prior AML research has focused mainly on spam, malware, and traditional network IDSs, while ICS-specific evidence remains limited. Existing ICS work includes preliminary manual perturbations and gradient-based approaches, leaving room for broader empirical investigation.

Research landscape: AML research has concentrated on spam filters, malware classifiers, and, more recently, traditional network IDSs rather than ICS environments.The paper characterizes AML research in ICS as receiving less attention to date.
Prior AML studies: Prior studies showed that modifying a small portion of training data can bypass spam filters and confuse malware classifiers.The cited malware work is described as a white-box attack requiring dataset or feature knowledge; another method is described as black-box.
ICS-specific work: ICS-specific AML investigations were scarce, including a preliminary LSTM attack based on manually selected feature or actuator perturbations.The passage also mentions a gradient-based search approach evaluated on a Simulink model.

III. INDUSTRIAL CONTROL SYSTEM CASE STUDY: POWER SYSTEM

The case study uses a scaled-down but representative power-system testbed that captures core functions of a larger system. Its components include generators, IED-controlled breakers, protection schemes, manual overrides, and monitoring devices.

Testbed: The power-system framework is a scaled-down testbed considered representative of a larger power system.The testbed was implemented by Mississippi State University and Oak Ridge National Laboratory.
Components: G1 and G2 serve as the main generators in the power-system framework.
Components: R1–R4 are IEDs that automatically operate corresponding breakers BR1–BR4 to protect electrical circuits.Each IED controls one breaker.
Protection and control: The IEDs use distance protection to trip breakers on detected faults, without internally distinguishing valid from invalid faults.Operators can also manually trip breakers during maintenance.
Monitoring: Additional monitoring devices, including SNORT and Syslog servers, are connected to the testbed.

A. Dataset

The dataset combines benign and malicious power-system events generated across 15 datasets and supports supervised classification experiments. It includes synchrophasor, control-panel, alert, and relay-log features.

Dataset composition: 15 datasets contain benign and malicious power-system data generated from five attack scenarios.Benign activity combines ‘no event’ and ‘natural event’ instances.
Attack scenarios: The attack scenarios include short-circuit faults, line maintenance, remote tripping command injection, and relay setting changes.The supplied passage begins describing the attack scenarios but does not include the full final scenario description.
Dataset composition: The dataset contains 55,663 malicious and 22,714 benign data points.
Experimental use: The experiments train supervised classifiers on the power-system data and evaluate their ability to detect cyber attacks.
Features: The dataset contains 128 features, including 116 synchrophasor measurement columns and 12 control-panel, SNORT-alert, and relay-log measurements.The synchrophasor measurements come from four PMUs, with 29 measurement types per unit.
Features: Feature identifiers use an R#-Signal Reference format that indicates the measurement type and its source PMU.For example, R1-PA1:VH denotes a phase-A voltage phase angle measured by PMU R1.

B. Model Training

The study evaluates supervised classifiers for distinguishing malicious from benign ICS data using cross-validation and a 60% training, 40% testing split. Random Forest and unpruned J48 achieved the highest reported F1-scores.

The classification task distinguishes malicious from benign data points using true positives, true negatives, false positives, and false negatives.
Precision, Recall, and F1-score are used to evaluate classifier performance from the resulting classification outputs.
The classifiers were evaluated with 10-fold cross-validation using default hyper-parameters and selected for support of high-dimensional feature spaces.
Approximately 60% of the dataset was used for training and the remaining 40% for testing.
Random Forest and unpruned J48 achieved the highest reported F1-scores, at 0.93 and 0.87 respectively.

V. ADVERSARIAL MACHINE LEARNING

Adversarial machine learning introduces perturbations to unseen data points to confuse a pre-trained model. The paper frames these attacks as methods for automatically generating adversarial samples.

Adversarial machine learning automatically introduces perturbations to unseen data points to confuse a pre-trained model.

A. Adversarial Attack Types

Adversarial attacks are categorized by their influence, security violation, specificity, privacy, complexity, and the attacker’s knowledge. The paper focuses experimentally on JSMA-generated perturbations in a grey-box setting.

Attack dimensions: Attacks may be causative during learning or exploratory during testing, with the latter including evasion attacks.
Attack dimensions: Security violations concern model integrity through misclassification or a sufficiently high misclassification rate that makes the model unusable.
Attack dimensions: Specificity distinguishes targeted attacks from indiscriminate attacks that do not target a specific value.
Attack dimensions: Attacks can seek information extraction, vary in complexity, and range from reducing prediction confidence to misclassifying all unseen data points.
Experimental attack: The experiments use a grey-box attack: the attacker knows the full dataset and features but not the target model, relying on adversarial-sample transferability.
Experimental attack: JSMA progressively perturbs a small percentage of features, allowing the attacker to specify both the perturbed-feature percentage and perturbation amount.

VI. EVALUATING SUPERVISED MODELS ON ADVERSARIAL SAMPLES

The classifiers were evaluated on JSMA-generated adversarial samples across parameter combinations. Performance varied by model and parameters, with J48 generally declining and Random Forest showing one pronounced degradation.

Both Random Forest and J48 initially achieved F1-scores of 0.67 and 0.66, respectively, on the original testing dataset.
The experiments evaluated weighted-averaged F1-scores after combining JSMA-generated adversarial samples with benign testing data.
J48’s F1-score decreased across most θ and γ combinations, although it reached 0.69 for θ = 0.3, γ = 0.2 and θ = 0.2, γ = 0.7.
Random Forest’s F1-score increased for most parameter pairs but fell by 16 percentage points to 0.57 at θ = 0.2, γ = 0.4.
The findings emphasize JSMA parameter tuning and note that higher F1-score is not necessarily undesirable to an attacker focused on benign classification of malicious points.
Confusion matrices showed a significant increase in false positives across both classifiers on adversarial samples.

VII. DEFENDING ADVERSARIAL MACHINE LEARNING

Adversarial training incorporated selected adversarial testing points into the training data and improved classification performance on unseen adversarial samples. Random Forest improved across all parameter combinations, while J48 improved substantially in fewer cases.

Adversarial training included 20% of adversarial data points from the performance-degrading settings in the original training dataset.
Retrained Random Forest and J48 models achieved cross-validation F1-scores of 0.94 and 0.89, respectively.
Following adversarial training, Random Forest and J48 achieved F1-scores of 0.76 and 0.80, increasing by 2 and 11 percentage points, respectively.
Random Forest improved for all JSMA parameter combinations, whereas only around 30% of J48 performances increased significantly.
The stronger overall Random Forest improvement is consistent with its ensemble structure of decision trees, including J48-like trees.

VIII. CONCLUSION

The paper examines whether JSMA-generated adversarial samples can undermine supervised ICS intrusion-detection models using an authentic power system dataset. It finds reduced performance under attack and improved robustness after adversarial training.

The results support evaluating and strengthening machine-learning-based IDSs against AML attacks in ICS environments.
The study uses JSMA to generate adversarial samples with varying noise levels and numbers of perturbed features for supervised classifiers trained on an authentic power system dataset.
Adversarial training used 20% of generated adversarial points, and Random Forest showed a greater improvement than J48 across JSMA parameter combinations.

IX. FUTURE WORK

Future work should broaden evaluation beyond JSMA and the models examined here, while recognizing that adversarial training may not cover all possible AML attacks.

The study should be extended to other adversarial-sample methods, including Iterative Gradient Sign, Carlini Wagner, and Generative Adversarial Networks.
Future investigations should examine AML against additional models such as LSTMs.
Adversarial training may be insufficient because anticipating every possible AML attack is difficult, motivating investigation of other defense mechanisms.