RNN-based Early Cyber-Attack Detection for the Tennessee Eastman Process

Abstract

An RNN-based forecasting approach is used to early detect anomalies in industrial multivariate time series data from a simulated Tennessee Eastman Process (TEP) with many cyber-attacks. This work continues a previously proposed LSTM-based approach to the fault detection in simpler data. It is considered necessary to adapt the RNN network to deal with data containing stochastic, stationary, transitive and a rich variety of anomalous behaviours. There is particular focus on early detection with special NAB-metric. A comparison with the DPCA approach is provided. The generated data set is made publicly available.

arXiv commentICML 2017 Time Series Workshop, Sydney, Australia, 2017

References in corpus (3)

• Evaluating Real-time Anomaly Detection Algorithms - the Numenta Anomaly Benchmark
• LSTM-based Encoder-Decoder for Multi-sensor Anomaly Detection
• ODE - Augmented Training Improves Anomaly Detection in Sensor Data from Machines

Cited by in corpus (8)

• Deep Learning for Anomaly Detection: A Survey
• Anomaly Detection for Water Treatment System based on Neural Network with Automatic Architecture Optimization
• Online Model-based Anomaly Detection in Multivariate Time Series: Taxonomy, Survey, Research Challenges and Future Directions
• Discovering Signals from Web Sources to Predict Cyber Attacks
• Unsupervised Deep Anomaly Detection for Multi-Sensor Time-Series Signals
• Anomalous Example Detection in Deep Learning: A Survey
• On the Veracity of Cyber Intrusion Alerts Synthesized by Generative Adversarial Networks
• Unsupervised Learning Based Robust Multivariate Intrusion Detection System for Cyber-Physical Systems using Low Rank Matrix