Enhanced Anomaly Detection in Industrial Control Systems aided by Machine Learning

TL;DR

It is suggested that integrating network traffic with operational process data can enhance detection capabilities, evidenced by improved recall rates for cyber attack classification.

Abstract

Traditional intrusion detection systems (IDSs) often rely on either network traffic or process data, but this single-source approach may miss complex attack patterns that span multiple layers within industrial control systems (ICSs) or persistent threats that target different layers of operational technology systems. This study investigates whether combining both network and process data can improve attack detection in ICSs environments. Leveraging the SWaT dataset, we evaluate various machine learning models on individual and combined data sources. Our findings suggest that integrating network traffic with operational process data can enhance detection capabilities, evidenced by improved recall rates for cyber attack classification. Serving as a proof-of-concept within a limited testing environment, this research explores the feasibility of advancing intrusion detection through a multi-source data approach in ICSs. Although the results are promising, they are preliminary and highlight the need for further studies across diverse datasets and refined methodologies.

Figures (4)

• Figure 1: Network Architecture of the SWaT Physical Process swat_technical_report
• Figure 2: Block Diagram of the SWaT Physical Process swat_technical_report
• Figure 3: Histogram showing the distribution of attack recall for baseline models
• Figure 4: Histogram showing the distribution of attack recall for combined models