GiBy: A Giant-Step Baby-Step Classifier For Anomaly Detection In Industrial Control Systems

TL;DR

GiBy introduces a real-time, explainable anomaly detector for industrial control systems by combining giant-step bound estimation with baby-step rate-of-change bounds, trained on normal SWaT data to form per-sensor $[LB,UB]$ boundaries. The method leverages a switchboard to map sensor–nn-actuator states into linearized state groups, enabling fast, interpretable anomaly explanations at millisecond speeds on resource-constrained hardware. Extended detection uses empirical window-based probabilities to capture longer-horizon anomalies, improving robustness against stealthier attacks. The approach emphasizes per-sensor boundaries, operator workload reduction, and near real-time applicability, with a measured re-defined accuracy of $97.72\%$ under practical criteria and clear explanations pin-pointing the responsible sensor and state. GiBy demonstrates competitive performance while maintaining transparency, allowing deployment in edge devices and other critical sectors; future work includes enhanced defenses against undetectable attacks and security hardening through signatures and encryption.

Abstract

The continuous monitoring of the interactions between cyber-physical components of any industrial control system (ICS) is required to secure automation of the system controls, and to guarantee plant processes are fail-safe and remain in an acceptably safe state. Safety is achieved by managing actuation (where electric signals are used to trigger physical movement), dependent on corresponding sensor readings; used as ground truth in decision making. Timely detection of anomalies (attacks, faults and unascertained states) in ICSs is crucial for the safe running of a plant, the safety of its personnel, and for the safe provision of any services provided. We propose an anomaly detection method that involves accurate linearization of the non-linear forms arising from sensor-actuator(s) relationships, primarily because solving linear models is easier and well understood. We accomplish this by using a well-known water treatment testbed as a use case. Our experiments show millisecond time response to detect anomalies, all of which are explainable and traceable; this simultaneous coupling of detection speed and explainability has not been achieved by other state of the art Artificial Intelligence (AI)/ Machine Learning (ML) models with eXplainable AI (XAI) used for the same purpose. Our methods explainability enables us to pin-point the sensor(s) and the actuation state(s) for which the anomaly was detected. The proposed algorithm showed an accuracy of 97.72% by flagging deviations within safe operation limits as non-anomalous; indicative that slower detectors with highest detection resolution is unnecessary, for systems whose safety boundaries provide leeway within safety limits.

Figures (12)

• Figure 1: Safe state determination using sensors. Boundaries are fed into a programmable logic controller. Lower bound (LB) and upper bound (UB).
• Figure 2: A sensor and dependent series-parallel actuators in a physical process. Its nearest neighbor actuator(s) are shown inside the dotted rectangle.
• Figure 3: The actuators a4-a6 are for non-nearest neighbors w.r.t. Fig. \ref{['fig:nonlinear']}. a1-a3 and a7-a8 are nearest neighbors. The $x_i$'s are their actuation state. Sensor $s = s_1$ is considered here. At times $t+1$, $t+2$, $t+3$, the actuation state of a7, a2 and a6, namely, $x7$, $x2$, and $x6$ changed. For brevity only binary actuation is shown. Even when a4-a6 are ignored, the sensor reading and its overall boundaries will remains unchanged. However, ignoring the non-nearest neighbors might result in a loss in detection resolution. This further depends on whether those actuators are capable of affecting the sensor reading. Any included actuator whose states does not affect the sensor reading may be considered as a do not care actuator. In the case the sensor-actuator(s) relationship is available from the design document or an expert is able to deduce those relationships, it may be possible to further refine the actuators related to the sensor --- to minimise resolution loss.
• Figure 4: High level system architecture of SWaT water treatment testbed Goh2016ADT.
• Figure 5: Mid-granular level view of $P_1$ and early $P_2$ SWaT process stages.