The DOI matches its Crossref record; 58 of the 58 references it cites were found in a registry or an index.
Efficient Cyber Attack Detection in Industrial Control Systems Using Lightweight Neural Networks and PCA
Open accessAbstract
Industrial control systems (ICSs) are widely used and vital to industry and society. Their failure can have severe impact on both the economy and human life. Hence, these systems have become an attractive target for physical and cyber attacks alike. In this article, we examine an attack detection method based on simple and lightweight neural networks, namely, 1D convolutional neural networks and autoencoders. We apply these networks to both the time and frequency domains of the data and discuss the pros and cons of each representation approach. The suggested method is evaluated on three popular public datasets, and detection rates matching or exceeding previously published detection results are achieved, while demonstrating a small footprint, short training and detection times, and generality. We also show the effectiveness of PCA, which, given proper data preprocessing and feature selection, can provide high attack detection rates in many settings. Finally, we study the proposed method’s robustness against adversarial attacks that exploit inherent blind spots of neural networks to evade detection while achieving their intended physical effect. Our results show that the proposed method is robust to such evasion attacks: in order to evade detection, the attacker is forced to sacrifice the desired physical impact on the system.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The text we found for this paper looks like another document, so the self-check wasn’t run.
Citations
Cites
On Information and Sufficiency
Kullback, S., & Leibler, R. A. (1951) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177729694 · Cited by 20,193
Intriguing properties of neural networks
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143
Chapelle, O., Schölkopf, B., & Zien, A. (2006) · The MIT Press eBooks · doi:10.7551/mitpress/9780262033589.001.0001 · Cited by 4,642
Genetic Algorithms and Machine Learning
Goldberg, D. E., & Holland, J. H. (1988) · Machine Learning · doi:10.1023/a:1022602019183 · Cited by 3,193
Wild patterns: Ten years after the rise of adversarial machine learning
Biggio, B., & Roli, F. (2018) · Pattern Recognition · doi:10.1016/j.patcog.2018.07.023 · Cited by 1,563
Investigating Ad Transparency Mechanisms in Social Media: A Case Study of Facebook's Explanations
Andreou, A., Venkatadri, G., Goga, O., Gummadi, K. P., Loiseau, P., & Mislove, A. E. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23191 · Cited by 1,505
Disturbance detection and isolation by dynamic principal component analysis
Ku, W., Storer, R. H., & Georgakis, C. (1995) · Chemometrics and Intelligent Laboratory Systems · doi:10.1016/0169-7439(95)00076-3 · Cited by 1,484
Anomaly Detection Using Autoencoders with Nonlinear Dimensionality Reduction
Sakurada, M., & Yairi, T. (2014) · Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis · doi:10.1145/2689746.2689747 · Cited by 1,438
MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks
Li, D., Chen, D., Jin, B., Shi, L., Goh, J., & Ng, S.-K. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-30490-4_56 · Cited by 1,323
Cyber-Physical Systems Security—A Survey
Humayed, A., Lin, J., Li, F., & Luo, B. (2017) · IEEE Internet of Things Journal · doi:10.1109/jiot.2017.2703172 · Cited by 1,185
A survey of intrusion detection techniques for cyber-physical systems
Mitchell, R., & Chen, I.-R. (2014) · ACM Computing Surveys · doi:10.1145/2542049 · Cited by 768
Kushner, D. (2013) · IEEE Spectrum · doi:10.1109/mspec.2013.6471059 · Cited by 638
Ahmed, C. M., Palleti, V. R., & Mathur, A. P. (2017) · International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater) · doi:10.1145/3055366.3055375 · Cited by 574
A survey of physics-based attack detection in cyber-physical systems
Giraldo, J., Urbina, D., Cardenas, A., Valente, J., Faisal, M., Ruths, J., Tippenhauer, N. O., Sandberg, H., & Candell, R. (2019) · ACM Computing Surveys · doi:10.1145/3203245 · Cited by 535
Mo, Y., Weerakkody, S., & Sinopoli, B. (2015) · IEEE Control Systems · doi:10.1109/mcs.2014.2364724 · Cited by 508
Attack models and scenarios for networked control systems
Teixeira, A. M. H., Perez, D. V., Sandberg, H., & Johansson, K. H. (2012) · International Conference on High Confidence Networked Systems · doi:10.1145/2185505.2185515 · Cited by 492
Anomaly Detection in Cyber Physical Systems Using Recurrent Neural Networks
Goh, J., Adepu, S., Tan, M., & Lee, Z. S. (2017) · IEEE International Symposium on High Assurance Systems Engineering (HASE) · doi:10.1109/hase.2017.36 · Cited by 447
Detecting Cyber Attacks in Industrial Control Systems Using Convolutional Neural Networks
Kravchik, M., & Shabtai, A. (2018) · Workshop on Cyber-Physical Systems Security and PrivaCy (CPS-SPC) · doi:10.1145/3264888.3264896 · Cited by 421
Self-citationKitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection
Mirsky, Y., Doitshman, T., Elovici, Y., & Shabtai, A. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23204 · Cited by 374
Self-citationAnomaly Detection for a Water Treatment System Using Unsupervised Machine Learning
Inoue, J., Yamagata, Y., Chen, Y., POSKITT, C. M., & Sun, J. (2017) · IEEE ... International Conference on Data Mining workshops · doi:10.1109/icdmw.2017.149 · Cited by 372
Machine learning for power system disturbance and cyber-attack discrimination
Hink, R. B., Beaver, J. M., Buckner, M. A., Morris, T., Adhikari, U., & Pan, S. (2014) · International Symposium on Resilient Control Systems (ISRCS) · doi:10.1109/isrcs.2014.6900095 · Cited by 336
Adversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2022) · ACM Computing Surveys · doi:10.1145/3453158 · Cited by 295
Self-citationSecurity and privacy in cyber-physical systems: A survey of surveys
Giraldo, J., Sarkar, E., Cardenas, A. A., Maniatakos, M., & Kantarcioglu, M. (2017) · IEEE Design & Test · doi:10.1109/mdat.2017.2709310 · Cited by 289
Cyber-physical attacks in power networks: Models, fundamental limitations and monitor design
Pasqualetti, F., Dörfler, F., & Bullo, F. (2011) · doi:10.1109/cdc.2011.6160641 · Cited by 282
Battle of the Attack Detection Algorithms: Disclosing Cyber Attacks on Water Distribution Networks
Taormina, R., Galelli, S., Tippenhauer, N. O., Salomons, E., Ostfeld, A., Eliades, D. G., Aghashahi, M., Sundararajan, R., Pourahmadi, M., Banks, M. K., et al. (2018) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0000969 · Cited by 277 · cited 3×
“Figure 7 shows that the status of the valve was not replayed, although the authors of [37] reported that it was.”
BackgroundMethodInfluentialMitchell, R., & Chen, I.-R. (2014) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2014.2312327 · Cited by 247
Intrusion Detection in Cyber-Physical Systems: Techniques and Challenges
Han, S., Xie, M., Chen, H., & Ling, Y. (2014) · IEEE Systems Journal · doi:10.1109/jsyst.2013.2257594 · Cited by 203
An Evaluation of Machine Learning Methods to Detect Malicious SCADA Communications
Beaver, J. M., Hink, R. B., & Buckner, M. A. (2013) · International Conference on Machine Learning and Applications · doi:10.1109/icmla.2013.105 · Cited by 198
Hadžiosmanović, D., Sommer, R., Zambon, E., & Hartel, P. (2014) · Annual Computer Security Applications Conference · doi:10.1145/2664243.2664277 · Cited by 190
Ramu, A., & Haldorai, A. (2018) · Lecture notes in computational vision and biomechanics · doi:10.1007/978-3-319-71767-8_9 · Cited by 190
Handbook of Methods of Applied Statistics
Brillinger, D. R., Chakravarti, I. M., Laha, R. G., & Roy, J. (1968) · Revue de l Institut International de Statistique / Review of the International Statistical Institute · doi:10.2307/1401615 · Cited by 177
Characterizing Cyber-Physical Attacks on Water Distribution Systems
Taormina, R., Galelli, S., Tippenhauer, N. O., Salomons, E., & Ostfeld, A. (2017) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0000749 · Cited by 175
Lin, Q., Adepu, S., Verwer, S., & Mathur, A. P. (2018) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3196494.3196546 · Cited by 157
Comparative study of different wavelet based neural network models for rainfall–runoff modeling
Shoaib, M., Shamseldin, A. Y., & Melville, B. W. (2014) · Journal of Hydrology · doi:10.1016/j.jhydrol.2014.04.055 · Cited by 153
Multi-Agent Approach for Enhancing Security of Protection Schemes in Cyber-Physical Energy Systems
Rahman, M. S., Mahmud, M. A., Oo, A. M. T., & Pota, H. R. (2016) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2016.2612645 · Cited by 153
Secure State Estimation Against Sensor Attacks in the Presence of Noise
Mishra, S., Shoukry, Y., Karamchandani, N., Diggavi, S. N., & Tabuada, P. (2016) · IEEE Transactions on Control of Network Systems · doi:10.1109/tcns.2016.2606880 · Cited by 146
Taormina, R., & Galelli, S. (2018) · Journal of Water Resources Planning and Management · doi:10.1061/(asce)wr.1943-5452.0000983 · Cited by 139
Evaluating Electricity Theft Detectors in Smart Grid Networks
Mashima, D., & Cárdenas, Á. A. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-33338-5_11 · Cited by 136
Uncertainty principles in Fourier analysis
Bruijn, D. N. D. (1967) · TU/e Research Portal · Cited by 114
Anomaly detection in cyber-physical systems: A formal methods approach
Jones, A. M., Kong, Z., & Belta, C. A. (2014) · Proceedings of the IEEE Conference on Decision & Control, including the Symposium on Adaptive Processes · doi:10.1109/cdc.2014.7039487 · Cited by 111
Aoudi, W., Iturbe, M., & Almgren, M. (2018) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3243734.3243781 · Cited by 110
Ahmed, C. M., Zhou, J., & Mathur, A. P. (2018) · Annual Computer Security Applications Conference · doi:10.1145/3274694.3274748 · Cited by 104
A Review of Some Non-parametric Methods of Density Estimation
Fryer, M. J. (1977) · IMA Journal of Applied Mathematics · doi:10.1093/imamat/20.3.335 · Cited by 103
Model-based approach for cyber-physical attack detection in water distribution systems
Housh, M., & Ohar, Z. (2018) · Water Research · doi:10.1016/j.watres.2018.03.039 · Cited by 91
Characterization of a CUSUM model-based sensor attack detector
Murguia, C., & Ruths, J. (2016) · Proceedings of the IEEE Conference on Decision & Control, including the Symposium on Adaptive Processes · doi:10.1109/cdc.2016.7798446 · Cited by 75
Zeinolabedini, M., & Najafzadeh, M. (2019) · Environmental Monitoring and Assessment · doi:10.1007/s10661-019-7196-7 · Cited by 70
A Deep Learning-based Framework for Conducting Stealthy Attacks in Industrial Control SystemsPreprint
Feng, C., Li, T., Zhu, Z., & Chana, D. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1709.06397 · Cited by 50
Adversarial Regression for Detecting Attacks in Cyber-Physical Systems
Ghafouri, A., Vorobeychik, Y., & Koutsoukos, X. (2018) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2018/524 · Cited by 48
Abokifa, A. A., Haddad, K., Lo, C. S., & Biswas, P. (2017) · World Environmental and Water Resources Congress 2017 · doi:10.1061/9780784480625.063 · Cited by 42
Stealthy Deception Attacks Against SCADA Systems
Kleinmann, A., Amichay, O., Wool, A., Tenenbaum, D., Bar, O., & Lev, L. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-72817-9_7 · Cited by 40
Context-Awareness Using Anomaly-Based Detectors for Smart Grid Domains
Alcaraz, C., Cazorla, L., & Fernández, G. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-17127-2_2 · Cited by 39
Mishra, V. K., Palleti, V. R., & Mathur, A. P. (2019) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2019.05.001 · Cited by 29
Sehatbakhsh, N., Nazari, A., Khan, H. A., Zajic, A. G., & Prvulović, M. (2019) · IEEE/ACM International Symposium on Microarchitecture (MICRO) · doi:10.1145/3352460.3358261 · Cited by 24
Chandy, S. E., Rasekh, A., Barker, Z. A., Campbell, B., & Shafiee, M. E. (2017) · World Environmental and Water Resources Congress 2017 · doi:10.1061/9780784480625.057 · Cited by 23
Erba, A., Taormina, R., Galelli, S., Pogliani, M., Carminati, M., Zanero, S., & Tippenhauer, N. O. (2019) · arXiv (Cornell University) · Cited by 14
Physical Attestation in the Smart Grid for Distributed State Verification
Roth, T. P., & McMillin, B. (2016) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2016.2577021 · Cited by 13
Herzberg, A., & Kfir, Y. (2019) · doi:10.1145/3338499.3357358 · Cited by 10
Adversarial Learning in the Cyber Security DomainPreprint
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2020) · arXiv (Cornell University) · Cited by 10
Self-citation
Research works printed but not linked: 5
- 10.1007/978–3-319-71368-7_8 · DOI · Paper page
- Morris, Industrial control system simulation and data logging for intrusion detection system research, 3
- Goodfellow, 2016, Deep Learning, 1
- Croarkin, 2006, NIST/SEMATECH e-handbook of statistical methods, Nist/Sematech
- 10.1007/BF00113892 · DOI · Paper page
Cited by
Sorted by citations
Deep Learning Based Attack Detection for Cyber-Physical System Cybersecurity: A Survey
Zhang, J., Pan, L., Han, Q., Chen, C., Wen, S., & Xiang, Y. (2021) · IEEE/CAA Journal of Automatica Sinica · doi:10.1109/jas.2021.1004261 · Cited by 450
A Survey on Industrial Control System Testbeds and Datasets for Security Research
Conti, M., Donadel, D., & Turrin, F. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3094360 · Cited by 284
Hương, T. T., Bac, T. P., Long, D. M., Luong, T. D., Dan, N. M., Quang, L. A., Cong, L. T., Thang, B. D., & Tran, K. P. (2021) · Computers in Industry · doi:10.1016/j.compind.2021.103509 · Cited by 201
A survey on deep learning for cybersecurity: Progress, challenges, and opportunities
Macas, M., Wu, C., & Fuertes, W. (2022) · Computer Networks · doi:10.1016/j.comnet.2022.109032 · Cited by 202
A Comprehensive Survey of Machine Learning Methodologies with Emphasis in Water Resources Management
Drogkoula, M., Kokkinos, K., & Samaras, N. (2023) · Applied Sciences · doi:10.3390/app132212147 · Cited by 163
Metadata
- Authors
- Kravchik, M., & Shabtai, A.
- Affiliations
- Ben-Gurion University of the Negev (IL)
- Venue
- IEEE Transactions on Dependable and Secure Computing
- Published
- 2022-07-01
- Volume
- 19
- Issue
- 4
- Pages
- 2179-2197
- ISSN
- 1545-5971 (ISSN-L)
- 1941-0018
- 2160-9209
- OpenAlex
- W3119781401
- Cited by
- 224
- References
- 56
- Citations by year
- 2026: 21 · 2025: 55 · 2024: 57 · 2023: 42 · 2022: 25
- FWCI
- 16.46
- Type
- journal article
- Language
- en
- Open access
- green
- zenodo.org
- Licence
- Locations
- IEEE Transactions on Dependable and Secure Computing (publishedVersion)
- Zenodo (CERN European Organization for Nuclear Research) (submittedVersion, cc-by)
- Funders
- H2020 European Institute of Innovation and Technology (830927)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- cyberattack detection, industrial control systems, lightweight neural networks, 1D convolutional neural network, autoencoder, principal component analysis, adversarial attacks, evasion attacks, physical assault, detection robustness
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
