Anomaly Detection for a Water Treatment System Using Unsupervised Machine Learning

Abstract

In this paper, we propose and evaluate the application of unsupervised machine learning to anomaly detection for a Cyber-Physical System (CPS). We compare two methods: Deep Neural Networks (DNN) adapted to time series data generated by a CPS, and one-class Support Vector Machines (SVM). These methods are evaluated against data from the Secure Water Treatment (SWaT) testbed, a scaled-down but fully operational raw water purification plant. For both methods, we first train detectors using a log generated by SWaT operating under normal conditions. Then, we evaluate the performance of both methods using a log generated by SWaT operating under 36 different attack scenarios. We find that our DNN generates fewer false positives than our one-class SVM while our SVM detects slightly more anomalies. Overall, our DNN has a slightly better F measure than our SVM. We discuss the characteristics of the DNN and one-class SVM used in this experiment, and compare the advantages and disadvantages of the two methods.

References in corpus (4)

• Scikit-learn: Machine Learning in Python
• Deep Structured Energy Based Models for Anomaly Detection
• Log-based Anomaly Detection of CPS Using a Statistical Method
• Towards Learning and Verifying Invariants of Cyber-Physical Systems by Code Mutation

Cited by in corpus (24)

• Deep Learning for Anomaly Detection: A Survey
• Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations
• Learning from Mutants: Using Code Mutation to Learn and Monitor Invariants of a Cyber-Physical System
• Unsupervised Deep Learning for IoT Time Series
• Anomaly Detection for Water Treatment System based on Neural Network with Automatic Architecture Optimization
• Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences
• Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunities
• Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems
• IPAL: Breaking up Silos of Protocol-dependent and Domain-specific Industrial Intrusion Detection Systems
• Active Fuzzing for Testing and Securing Cyber-Physical Systems
• ConAML: Constrained Adversarial Machine Learning for Cyber-Physical Systems
• Code Integrity Attestation for PLCs using Black Box Neural Network Predictions
• Efficient Cyber Attacks Detection in Industrial Control Systems Using Lightweight Neural Networks and PCA
• Detecting Cyberattacks in Industrial Control Systems Using Convolutional Neural Networks
• Finding Causally Different Tests for an Industrial Control System
• ROBUST: 221 Bugs in the Robot Operating System
• An Attention-Based Deep Generative Model for Anomaly Detection in Industrial Control Systems
• Runtime Anomaly Detection for Drones: An Integrated Rule-Mining and Unsupervised-Learning Approach
• LSTM-Based Anomaly Detection: Detection Rules from Extreme Value Theory
• Defending Water Treatment Networks: Exploiting Spatio-temporal Effects for Cyber Attack Detection
• Towards Systematically Deriving Defence Mechanisms from Functional Requirements of Cyber-Physical Systems
• Data-Driven Attack Detection for Linear Systems
• Batch Distillation Data for Developing Machine Learning Anomaly Detection Methods
• Developing a Strong CPS Defender: An Evolutionary Approach