Detecting cyber attacks in industrial control systems using convolutional neural networks

Moshe Kravchik; Asaf Shabtai

doi:10.1145/3264888.3264896

Detecting cyber attacks in industrial control systems using convolutional neural networks

Moshe Kravchik
, Asaf Shabtai

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

This paper presents a study on detecting cyber attacks on industrial control systems (ICS) using convolutional neural networks. The study was performed on a Secure Water Treatment testbed (SWaT) dataset, which represents a scaled-down version of a real-world industrial water treatment plant. We suggest a method for anomaly detection based on measuring the statistical deviation of the predicted value from the observed value. We applied the proposed method by using a variety of deep neural network architectures including different variants of convolutional and recurrent networks. The test dataset included 36 different cyber attacks. The proposed method successfully detected 31 attacks with three false positives thus improving on previous research based on this dataset. The results of the study show that 1D convolutional networks can be successfully used for anomaly detection in industrial control systems and outperform recurrent networks in this setting. The findings also suggest that 1D convolutional networks are effective at time series prediction tasks which are traditionally considered to be best solved using recurrent neural networks. This observation is a promising one, as 1D convolutional neural networks are simpler, smaller, and faster than the recurrent neural networks.

Original language	English
Title of host publication	CPS-SPC 2018 - Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2018
Pages	72-83
Number of pages	12
ISBN (Electronic)	9781450359924
DOIs	https://doi.org/10.1145/3264888.3264896
State	Published - 15 Oct 2018
Event	4th ACM Workshop on Cyber-Physical Systems Security and PrivaCy, CPS-SPC 2018, in conjunction with the 25th ACM Conference on Computer and Communications Security, CCS 2018 - Toronto, Canada Duration: 19 Oct 2018 → …

Publication series

Name	Proceedings of the ACM Conference on Computer and Communications Security

Conference

Conference	4th ACM Workshop on Cyber-Physical Systems Security and PrivaCy, CPS-SPC 2018, in conjunction with the 25th ACM Conference on Computer and Communications Security, CCS 2018
Country/Territory	Canada
City	Toronto
Period	19/10/18 → …

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 6 Clean Water and Sanitation
SDG 9 Industry, Innovation, and Infrastructure

Keywords

Anomaly detection
Convolutional neural networks
Industrial control systems

ASJC Scopus subject areas

Software
Computer Networks and Communications

Access to Document

10.1145/3264888.3264896

Cite this

Kravchik, M., & Shabtai, A. (2018). Detecting cyber attacks in industrial control systems using convolutional neural networks. In CPS-SPC 2018 - Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2018 (pp. 72-83). (Proceedings of the ACM Conference on Computer and Communications Security). https://doi.org/10.1145/3264888.3264896

@inproceedings{1f3f358112af4ac098c68a7886a4a949,

title = "Detecting cyber attacks in industrial control systems using convolutional neural networks",

abstract = "This paper presents a study on detecting cyber attacks on industrial control systems (ICS) using convolutional neural networks. The study was performed on a Secure Water Treatment testbed (SWaT) dataset, which represents a scaled-down version of a real-world industrial water treatment plant. We suggest a method for anomaly detection based on measuring the statistical deviation of the predicted value from the observed value. We applied the proposed method by using a variety of deep neural network architectures including different variants of convolutional and recurrent networks. The test dataset included 36 different cyber attacks. The proposed method successfully detected 31 attacks with three false positives thus improving on previous research based on this dataset. The results of the study show that 1D convolutional networks can be successfully used for anomaly detection in industrial control systems and outperform recurrent networks in this setting. The findings also suggest that 1D convolutional networks are effective at time series prediction tasks which are traditionally considered to be best solved using recurrent neural networks. This observation is a promising one, as 1D convolutional neural networks are simpler, smaller, and faster than the recurrent neural networks.",

keywords = "Anomaly detection, Convolutional neural networks, Industrial control systems",

author = "Moshe Kravchik and Asaf Shabtai",

note = "Publisher Copyright: {\textcopyright} 2018 Association for Computing Machinery.; 4th ACM Workshop on Cyber-Physical Systems Security and PrivaCy, CPS-SPC 2018, in conjunction with the 25th ACM Conference on Computer and Communications Security, CCS 2018 ; Conference date: 19-10-2018",

year = "2018",

month = oct,

day = "15",

doi = "10.1145/3264888.3264896",

language = "English",

series = "Proceedings of the ACM Conference on Computer and Communications Security",

pages = "72--83",

booktitle = "CPS-SPC 2018 - Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2018",

}

Kravchik, M & Shabtai, A 2018, Detecting cyber attacks in industrial control systems using convolutional neural networks. in CPS-SPC 2018 - Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2018. Proceedings of the ACM Conference on Computer and Communications Security, pp. 72-83, 4th ACM Workshop on Cyber-Physical Systems Security and PrivaCy, CPS-SPC 2018, in conjunction with the 25th ACM Conference on Computer and Communications Security, CCS 2018, Toronto, Canada, 19/10/18. https://doi.org/10.1145/3264888.3264896

Detecting cyber attacks in industrial control systems using convolutional neural networks. / Kravchik, Moshe; Shabtai, Asaf.
CPS-SPC 2018 - Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2018. 2018. p. 72-83 (Proceedings of the ACM Conference on Computer and Communications Security).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Detecting cyber attacks in industrial control systems using convolutional neural networks

AU - Kravchik, Moshe

AU - Shabtai, Asaf

PY - 2018/10/15

Y1 - 2018/10/15

N2 - This paper presents a study on detecting cyber attacks on industrial control systems (ICS) using convolutional neural networks. The study was performed on a Secure Water Treatment testbed (SWaT) dataset, which represents a scaled-down version of a real-world industrial water treatment plant. We suggest a method for anomaly detection based on measuring the statistical deviation of the predicted value from the observed value. We applied the proposed method by using a variety of deep neural network architectures including different variants of convolutional and recurrent networks. The test dataset included 36 different cyber attacks. The proposed method successfully detected 31 attacks with three false positives thus improving on previous research based on this dataset. The results of the study show that 1D convolutional networks can be successfully used for anomaly detection in industrial control systems and outperform recurrent networks in this setting. The findings also suggest that 1D convolutional networks are effective at time series prediction tasks which are traditionally considered to be best solved using recurrent neural networks. This observation is a promising one, as 1D convolutional neural networks are simpler, smaller, and faster than the recurrent neural networks.

AB - This paper presents a study on detecting cyber attacks on industrial control systems (ICS) using convolutional neural networks. The study was performed on a Secure Water Treatment testbed (SWaT) dataset, which represents a scaled-down version of a real-world industrial water treatment plant. We suggest a method for anomaly detection based on measuring the statistical deviation of the predicted value from the observed value. We applied the proposed method by using a variety of deep neural network architectures including different variants of convolutional and recurrent networks. The test dataset included 36 different cyber attacks. The proposed method successfully detected 31 attacks with three false positives thus improving on previous research based on this dataset. The results of the study show that 1D convolutional networks can be successfully used for anomaly detection in industrial control systems and outperform recurrent networks in this setting. The findings also suggest that 1D convolutional networks are effective at time series prediction tasks which are traditionally considered to be best solved using recurrent neural networks. This observation is a promising one, as 1D convolutional neural networks are simpler, smaller, and faster than the recurrent neural networks.

KW - Anomaly detection

KW - Convolutional neural networks

KW - Industrial control systems

UR - https://www.scopus.com/pages/publications/85056734630

U2 - 10.1145/3264888.3264896

DO - 10.1145/3264888.3264896

M3 - Conference contribution

T3 - Proceedings of the ACM Conference on Computer and Communications Security

SP - 72

EP - 83

BT - CPS-SPC 2018 - Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2018

T2 - 4th ACM Workshop on Cyber-Physical Systems Security and PrivaCy, CPS-SPC 2018, in conjunction with the 25th ACM Conference on Computer and Communications Security, CCS 2018

Y2 - 19 October 2018

ER -

Detecting cyber attacks in industrial control systems using convolutional neural networks

Abstract

Publication series

Conference

UN SDGs

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this