The prevalence of Internet-of-Things (IoT) technologies and the ubiquity of networked sensors and actuators in many industrial control systems (ICS) have led to the exposure of critical infrastructure in our society to malicious activities and cyber threats. Programmable logic controllers (PLCs) are embedded devices that automate ICS processes. PLCs, which serve as the heart of ICS, are vulnerable to attacks and system malfunctions like other embedded devices. Because PLCs are widely used to control ICS physical processes, attacks against PLCs can cause irreparable damage to enterprises and even loss of life. However, due to the unique and proprietary architecture of PLCs, it is not easy to apply traditional tools and techniques for PLC protection. This work presents an unsupervised learning approach for anomaly detection in ICS based on neural networks with one class objective function and additional regularization term. This technique combines the abilities of neural networks to learn complex relationships with a one-class objective function and a regularization term for separating normal conditions from anomalous operations. The newly introduced regularization term provides a model-tuning mechanism based on specific industrial requirements and performance metrics of interest (i.e., precision or recall). The model was evaluated on a recent real-world ICS dataset: the Secure Water Treatment (SWaT) dataset. The proposed technique’s performance is compared with previous work, showing improvements in terms of scalability and attack detection capability, proving that the proposed technique is suitable for use in real ICS scenarios. The proposed method with the regularization term demonstrated superior recall values in 15 out of the 36 attack scenarios in the SWaT dataset, which is the largest of any published methods in the literature. A qualitative analysis of the proposed technique on the SWaT security showdown event data further proves the technique’s high anomaly detection ability on real-time injected attacks.

The security of programmable logic controllers (PLCs) that control industrial systems is becoming increasingly critical due to the ubiquity of the Internet of Things technologies and increasingly nefarious cyber-attack activity. Conventional techniques for safeguarding PLCs are difficult due to their unique architectures. This work proposes a one-class support vector machine, one-class neural network interconnected in a feed-forward manner, and isolation forest approaches for verifying PLC process integrity by monitoring PLC memory addresses. A comprehensive experiment is conducted using an open-source PLC subjected to multiple attack scenarios. A new histogram-based approach is introduced to visualize anomaly detection algorithm performance and prediction confidence. Comparative performance analyses of the proposed algorithms using decision scores and prediction confidence are presented. Results show that isolation forest outperforms one-class neural network, one-class support vector machine, and previous work, in terms of accuracy, precision, recall, and F1-score on seven attack scenarios considered. Statistical hypotheses tests involving analysis of variance and Tukey’s range test were used to validate the presented results.

As the number of electric vehicles on roads significantly increases, spatial-temporal charging coordination mechanisms have been introduced for balancing charging demand and energy supply. However, electric vehicles could send false data, such as state-of-charge (SoC), to the charging coordination mechanism for gaining high charging priority illegally. Machine Learning models can be used to detect false data. However, in our application the detector is trained on a dataset that contains sensitive information, such as the locations and SoC values of the electric vehicles. Therefore, attackers could launch adversarial attacks against the detector, such as membership inference and model inversion, for revealing sensitive information on the drivers whose data are used to train the detector. Furthermore, attackers could launch evasion attacks against the detector by computing false SoC values that are classified benign by the detector. Addressing the three attacks simultaneously makes the problem more complicated because a countermeasure to one attack may degrade the model's accuracy and unintentionally make the model more susceptible to other attacks. Accordingly, in this paper, we propose a deep-learning training approach for false data detector in spatial-temporal charging coordination. Our approach can deal with the tradeoffs and balance the detector's accuracy and robustness against the adversarial attacks. Specifically, our approach combines three techniques, including mimic learning, dropout, and differential privacy, in a certain way that makes the detector highly accurate in detecting false data and also robust against adversarial attacks. To validate our approach, we have conducted a set of experiments and the given results demonstrate the robustness and accuracy of our detector.