Unsupervised and Incremental Learning Orchestration for Cyber-Physical Security

Lúcio Henrik Amorim Reis (1) , Andrés Felipe Murillo Piedrahita (2) , Sandra Julieta Rueda Rodríguez (2) , Natália Castro Fernandes (1) , Dianne Scherly Varela de Medeiros (1) , Marcelo Dias de Amorim (3) , Diogo Menezes Ferrazani Mattos (1)

1 UFF - Universidade Federal Fluminense [Rio de Janeiro]
2 UNIANDES - Universidad de los Andes [Bogota]
3 NPA - Networks and Performance Analysis

Attacks on cyber-physical systems, such as nuclear and water treatment plants, have physical consequences that impact the lives of thousands of citizens. In such systems, it is mandatory to monitor the field network and detect potential threats before a problem occurs. This work proposes a hybrid approach that orchestrates unsupervised and incremental learning methods to detect threats that impact the control loops in a plant. We use online data processing to identify new attack vectors. We train the online incremental learning method as new attacks arrive. We also apply a one-class support vector machine to each monitored sensor or actuator to retrieve abnormal behaviors of their closed control loop. The proposed solution orchestrates the outputs from the two machine learning methods and alerts the system operators when it detects a threat. We evaluate the proposal on the Secure Water Treatment testbed dataset, and the results reveal that our proposal detects threats at more than 90% precision and with accuracy higher than 95%.

Domaines: Réseaux et télécommunications [cs.NI]; Informatique ubiquitaire; Informatique mobile; Réseaux sociaux et d'information [cs.SI]

Lúcio Henrik Amorim Reis, Andrés Felipe Murillo Piedrahita, Sandra Julieta Rueda Rodríguez, Natália Castro Fernandes, Dianne Scherly Varela de Medeiros, et al.. Unsupervised and Incremental Learning Orchestration for Cyber-Physical Security. Transactions on emerging telecommunications technologies, 2020, 31 (7), pp.e4011. ⟨10.1002/ett.4011⟩. ⟨hal-02569404⟩