Anomaly Detection via One Class SVM for Protection of SCADA Systems
Abstract
Funded by European Framework-7 (FP7), the CockpicCI project aims at developing intelligent risk detection, analysis and protection techniques for Critical Infrastructures (CI). In this paper, we describes our recent research on automated anomaly detection from central Supervisory Control and Data Acquisition (SCADA) systems and their related commands/measurements in the SCADA-field equipment communications. The work exploits the concept of one-class SVM (Support Vector Machines) and adaptively controls its decision parameter to detect unusual patterns from inputs and generate alarms for on-site engineers to further investigate. Experiments on simulation data sets from telecommunication networks illustrate that the proposed algorithm achieves high detection rates, providing excellent potential for further research and development towards practical tools for protection of SCADA systems.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
HLA is a simulation integration platform designed by the Department of Defence that can be used to integrate simulators.
“HLA is a simulation integration platform designed by the Department of Defence (DoD) [45] that can be used to integrate simulators.”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [45]
Cited by
Sorted by citations
A survey of cyber security management in industrial control systems
Knowles, W., Prince, D., Hutchison, D., Disso, J. F. P., & Jones, K. (2015) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2015.02.002 · Cited by 344 · see citing works
Assessing and augmenting SCADA cyber security: A survey of techniques
Nazir, S., Patel, S., & Patel, D. (2017) · Computers & Security · doi:10.1016/j.cose.2017.06.010 · Cited by 167 · see citing works
“Machine learning techniques have been applied to telecommunications; [98] proposed one class SVM for automated anomaly detection from SCADA telecommunications data.”
BackgroundMethodInfluentialMachine Learning for DDoS Attack Detection in Industry 4.0 CPPSs
Saghezchi, F. B., Mantas, G., Violas, M. A., de Oliveira Duarte, A. M., & Rodriguez, J. (2022) · Electronics · doi:10.3390/electronics11040602 · Cited by 81 · see citing works
- Authors
- Jiang, J., & Yasakethu, L.
- Affiliations
- University of Surrey (GB)
- Dept. of Comput., Univ. of Surrey, Guildford, UK
- ORCID
- Jiang, Jianmin
- Venue
- 2013 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery
- Publisher
- IEEE
- Published
- 2013-10
- Pages
- 82-88
- OpenAlex
- W1989429174
- Cited by
- 47
- References
- 0
- Citations by year
- 2025: 2 · 2024: 2 · 2023: 5 · 2022: 5 · 2021: 5 · 2020: 8 · 2019: 2 · 2018: 1 · 2017: 6 · 2016: 4 · 2015: 5 · 2014: 2
- FWCI
- 5.01
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC) (publishedVersion)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- anomaly detection, one-class support vector machine, SCADA systems, critical infrastructure protection, intrusion detection, alarm generation, telecommunications networks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
