Anomaly detection has been known as an effective technique to detect faults or cyber-attacks in industrial control systems (ICS). Therefore, many anomaly detection models have been proposed for ICS. However, most models have been implemented and evaluated under specific circumstances, which leads to confusion about choosing the best model in a real-world situation. In other words, there still needs to be a comprehensive comparison of state-of-the-art anomaly detection models with common experimental configurations. To address this problem, we conduct a comparative study of five representative time series anomaly detection models: InterFusion, RANSynCoder, GDN, LSTM-ED, and USAD. We specifically compare the performance analysis of the models in detection accuracy, training, and testing times with two publicly available datasets: SWaT and HAI. The experimental results show that the best model results are inconsistent with the datasets. For SWaT, InterFusion achieves the highest $F1$-$score$ of 90.7% while RANSynCoder achieves the highest $F1$-$score$ of 82.9% for HAI. We also investigate the effects of the training set size on the performance of anomaly detection models. We found that about 40% of the entire training set would be sufficient to build a model producing a similar performance compared to using the entire training set.

Sensor data on a user’s mobile device can often be used to identify the user for improving the security of smartphones in indoor environments. In this paper, we present a novel continuous user identification system called LightLock that collects light sensor data from a user’s smartphone and analyzes them to identify a specific user using a machine learning approach. We develop a multi-model system to extract four different feature vectors: (1) absolute time series (ATS); (2) auto-correlation function (ACF); (3) level crossing rate (LCR); and (4) peak readings detection (PRD). To show the feasibility of LightLock, we implemented an Android application and evaluated the performance of LightLock on the dataset collected during a period of 20 days. LightLock achieves over 98% accuracy in identifying a specific user. LightLock also provides an accurate and cost-less alternative solution to existing approaches that require explicit user-smartphone interaction or the high energy consumption of multiple sensors.

A user’s location information can be used to identify the user. For example, in Android, we can keep our smartphone unlocked when it is located near a place that was previously registered as a trusted place. However, existing location-based user authentication solutions failed to support fine-grained indoor location registration. In this article, we present a highly accurate identification scheme named location-based identification (LocID) using the smartphone’s physical fingerprints that are sensed at the user’s secure area. Our key idea is to use Wi-Fi signals and the light intensity of smartphones’ fingerprints to accurately identify their locations within adjacent indoor areas. To generate stable and reliable location fingerprints, we develop a novel mathematical location-wise signal signature (LSS) algorithm by minimizing the bias highly affected by various environmental factors. To show the feasibility of LocID, we evaluated the performance using machine learning classifiers with a real-world data set containing Wi-Fi and light fingerprints from 68 locations in a building for five weeks. The experimental results show that LocID achieved an F1-score of 98.3%, false-negative rate (FNR) of 2.9%, and false-positive rate (FPR) of 1.7%, respectively, when LocID was retrained daily. Moreover, LocID achieved an F1-score of 94.4%, FNR of 2.7%, and FPR of 3.7%, respectively, when LocID was trained using the data set during the first week and tested with the remaining four weeks data set. Also, we tested LocID using only one-scan of location fingerprints and achieved 90.6% and 90.8% AUC scores for support vector machine and $K$ -nearest neighbor classifiers, respectively.