Mukhtar Hussain

Industrial Control Systems (ICSs) were initially designed to be operated in an isolated network. However, recently, ICSs have been increasingly connected to the Internet to expand their capability, such as remote management. This interconnectivity of ICSs exposes them to cyber-attacks. At the same time, cyber-attacks in ICS networks are different compared to traditional Information Technology (IT) networks. Cyber attacks on ICSs usually involve a sequence of actions and a multitude of devices. However, current anomaly detection systems only focus on local analysis, which misses the correlation between devices and the progress of attacks over time. As a consequence, they lack an effective way to detect attacks at an entire network scale and predict possible future actions of an attack, which is of significant interest to security analysts to identify the weaknesses of their network and prevent similar attacks in the future. To address these two key issues, this paper presents a system-wide anomaly detection solution using recurrent neural networks combined with correlation analysis techniques. The proposed solution has a two-layer analysis. The first layer targets attack detection, and the second layer analyses the detected attack to predict the next possible attack actions. The main contribution of this paper is the proof of the concept implementation using two real-world ICS datasets, SWaT and Power System Attack. Moreover, we show that the proposed solution effectively detects anomalies and attacks on the scale of the entire ICS network.

In a multimode industrial control system, mode switching decisions have to follow standard operating procedures which are set for the safety of the system based on the operating limitations of equipment. A rich literature can be found on monitoring multimode systems. However, that work is mainly focused on mode identification and monitoring anomalies in the process running under each mode. Instead, we present a data-driven method for monitoring the modes’ switching constraints. This article is based on state-transition matrix and decision-tree methods to discover data-driven mode switching conditions. Moreover, our approach is not limited to only threshold based condition learning. To capture data trajectory-based conditions, we adopt a functional data descriptors method. In practical experiments, we showed that our approach can discover anomalous mode-switching decisions which cannot be discovered by previous multimode process-monitoring methods.

Detecting process-based attacks on industrial control systems (ICS) is challenging. These cyber-attacks are designed to disrupt the industrial process by changing the state of a system, while keeping the system's behaviour close to the expected behaviour. Such anomalous behaviour can be effectively detected by an event-driven approach. Petri Net (PN) model identification has proved to be an effective method for event-driven system analysis and anomaly detection. However, PN identification-based anomaly detection methods require ICS device logs to be converted into event logs (sequence of events). Therefore, in this paper we present a formalised method for pre-processing and transforming ICS device logs into event logs. The proposed approach outperforms the previous methods of device logs processing in terms of anomaly detection. We have demonstrated the results using two published datasets.

Secure wireless communication has always been a hot research topic due to the vulnerabilities associated with wireless channel. Physical layer aspects to secure wireless communication, based on the information-theoretic security and signal processing methods have gained much recognition over the last decade. Specifically, artificial noise (AN) methods are assumed to be good means for providing security against potential eavesdroppers in multi-input multi-output (MIMO) systems and/or relay systems. However, there are still a large number of nodes which do not have multi-antennas or support sophisticated protocols in wireless networks. In this paper, a novel AN-aided method is proposed to secure wireless communications between the legitimate users (not equipped with multiple antennas) in the presence of an eavesdropper. In this proposed method frequency selective property of wireless channel is exploited. The basic principle is same in which transmitter generate random AN signal utilizing some of the transmission power to confuse eavesdropper. However artificial noise is generated in such a way that it appears to be zero at the sampling time, only for the legitimate receiver while degrading eavesdropper's channel. Artificial noise is specified using the channel state information (CSI) of the legitimate users' link. However, the secrecy of proposed scheme doesn't depend on the secrecy of CSI. Extensive simulation suggests that the proposed scheme can effectively utilized for securing wireless transmissions.