Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Differential Privacy for Regulatory Compliance in Cyberattack Detection on Critical Infrastructure Systems

Paritosh Ramanan, H. M. Mohaimanul Islam, Abhiram Reddy Alugula

TL;DR

This work addresses privacy and regulatory verification for data-driven cyberattack detection in critical infrastructure by introducing a two-phase differential privacy framework that protects both covariance and residual statistics in a nonlinear state-space ICS model. It combines a learning-enabled nonlinear Kalman filter with chi-square and p-value based hypothesis testing to detect anomalies, while enabling regulator verification through DP-disclosed statistics. The authors derive formal DP guarantees, analyze the impact of privacy budgets and failure probabilities on detection performance, and propose two verification modalities—critical region and p-value based—so regulators can audit alarms without exposing sensitive data. Experimental results on real ICS datasets demonstrate that DP-disclosure strategies can closely match non-DP detection performance and provide robust privacy protection with manageable false alarm rates. The framework offers practical pathways to enhance trust, situational awareness, and regulatory credibility in interdependent CINs during cyber threat events.

Abstract

Industrial control systems are a fundamental component of critical infrastructure networks (CIN) such as gas, water and power. With the growing risk of cyberattacks, regulatory compliance requirements are also increasing for large scale critical infrastructure systems comprising multiple utility stakeholders. The primary goal of regulators is to ensure overall system stability with recourse to trustworthy stakeholder attack detection. However, adhering to compliance requirements requires stakeholders to also disclose sensor and control data to regulators raising privacy concerns. In this paper, we present a cyberattack detection framework that utilizes differentially private (DP) hypothesis tests geared towards enhancing regulatory confidence while alleviating privacy concerns of CIN stakeholders. The hallmark of our approach is a two phase privacy scheme that protects the privacy of covariance, as well as the associated sensor driven test statistics computed as a means to generate alarms. Theoretically, we show that our method induces a misclassification error rate comparable to the non-DP cases while delivering robust privacy guarantees. With the help of real-world datasets, we show the reliability of our DP-detection outcomes for a wide variety of attack scenarios for interdependent stakeholders.

Differential Privacy for Regulatory Compliance in Cyberattack Detection on Critical Infrastructure Systems

TL;DR

This work addresses privacy and regulatory verification for data-driven cyberattack detection in critical infrastructure by introducing a two-phase differential privacy framework that protects both covariance and residual statistics in a nonlinear state-space ICS model. It combines a learning-enabled nonlinear Kalman filter with chi-square and p-value based hypothesis testing to detect anomalies, while enabling regulator verification through DP-disclosed statistics. The authors derive formal DP guarantees, analyze the impact of privacy budgets and failure probabilities on detection performance, and propose two verification modalities—critical region and p-value based—so regulators can audit alarms without exposing sensitive data. Experimental results on real ICS datasets demonstrate that DP-disclosure strategies can closely match non-DP detection performance and provide robust privacy protection with manageable false alarm rates. The framework offers practical pathways to enhance trust, situational awareness, and regulatory credibility in interdependent CINs during cyber threat events.

Abstract

Industrial control systems are a fundamental component of critical infrastructure networks (CIN) such as gas, water and power. With the growing risk of cyberattacks, regulatory compliance requirements are also increasing for large scale critical infrastructure systems comprising multiple utility stakeholders. The primary goal of regulators is to ensure overall system stability with recourse to trustworthy stakeholder attack detection. However, adhering to compliance requirements requires stakeholders to also disclose sensor and control data to regulators raising privacy concerns. In this paper, we present a cyberattack detection framework that utilizes differentially private (DP) hypothesis tests geared towards enhancing regulatory confidence while alleviating privacy concerns of CIN stakeholders. The hallmark of our approach is a two phase privacy scheme that protects the privacy of covariance, as well as the associated sensor driven test statistics computed as a means to generate alarms. Theoretically, we show that our method induces a misclassification error rate comparable to the non-DP cases while delivering robust privacy guarantees. With the help of real-world datasets, we show the reliability of our DP-detection outcomes for a wide variety of attack scenarios for interdependent stakeholders.

Paper Structure

This paper contains 40 sections, 9 theorems, 70 equations, 6 figures, 4 tables, 4 algorithms.

Table of Contents

  1. Introduction
  2. Related Work
  3. State Space Modeling for ICS
  4. Non-Linear State Space Formulation
  5. Non-linear Kalman Filter Estimation
  6. Learning the Non Linear Kalman Filter
  7. Hypothesis Tests for Anomaly Detection
  8. Privacy Preserving Detection Scheme
  9. Privacy Scope and Objectives
  10. Differential Privacy Primer
  11. Privacy Preserving Covariance Disclosures
  12. Privacy Preserving Residual Disclosure
  13. Integrating Covariance and Residual Privacy
  14. Privacy Preserving Algorithmic Framework
  15. Critical Region Based Verification
  16. ...and 25 more sections

Key Result

Lemma 4.1

The original and the perturbed test statistics $\hat{T}^{cov}_{\chi^2,t}$, $T_{\chi^2,t}$ satisfy the following relation for $p\leq d$: where $R_t = \sum\limits^{p}_{i=1} (r^i_t)^2$ and $\theta_l = (\frac{\Delta_l}{\epsilon_{cov}}log(\frac{d}{\gamma_{cov}}))$

Figures (6)

  • Figure 1: Compliance-driven, private ICS attack detection
  • Figure 2: Framework for learning Non Linear Kalman Filter
  • Figure 3: HAI Dataset: P-Value trends for varying DP parameter values
  • Figure 4: ORNL-PS Dataset: P-Value trends for varying DP parameter values
  • Figure 5: HAI Dataset: Test statistic trends for varying DP parameter values
  • ...and 1 more figures

Theorems & Definitions (30)

  • Definition 1
  • Definition 2
  • Definition 3
  • Lemma 4.1
  • proof
  • Lemma 4.2
  • proof
  • Lemma 4.3
  • proof
  • Theorem 4.1
  • ...and 20 more