An Improved Industrial Control System Device Logs Processing Method for Process-Based Anomaly Detection
- 1 December 2019
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- p. 150-1505
Abstract
Detecting process-based attacks on industrial control systems (ICS) is challenging. These cyber-attacks are designed to disrupt the industrial process by changing the state of a system, while keeping the system's behaviour close to the expected behaviour. Such anomalous behaviour can be effectively detected by an event-driven approach. Petri Net (PN) model identification has proved to be an effective method for event-driven system analysis and anomaly detection. However, PN identification-based anomaly detection methods require ICS device logs to be converted into event logs (sequence of events). Therefore, in this paper we present a formalised method for pre-processing and transforming ICS device logs into event logs. The proposed approach outperforms the previous methods of device logs processing in terms of anomaly detection. We have demonstrated the results using two published datasets.Keywords
This publication has 19 references indexed in Scilit:
- From System Specification to Anomaly Detection (and back)2017
- From Intrusion Detection to Software Design2017
- Process Mining2016
- A Black-Box Identification Method for Automated Discrete-Event SystemsIEEE Transactions on Automation Science and Engineering, 2015
- Model Identification and Synthesis of Discrete‐Event Systems2015
- Discovering Block-Structured Process Models from Event Logs - A Constructive Approach2013
- Replaying history on process models for conformance checking and performance analysisWIREs Data Mining and Knowledge Discovery, 2012
- Anomaly Detection Using Model Generation for Event-Based Systems Without a Preexisting Formal ModelIEEE Transactions on Systems, Man, and Cybernetics - Part A: Systems and Humans, 2011
- Using penalized contrasts for the change-point problemSignal Processing, 2005
- Hybrid Control Systems: An Introductory Discussion to the Special IssueIEEE Transactions on Automatic Control, 1998