A Causality-Inspired Approach for Anomaly Detection in a Water Treatment Testbed

Georgios Koutroulis, Belgin Mutlu, Roman Kern*

*Korrespondierende/r Autor/-in für diese Arbeit

Publikation: Beitrag in einer FachzeitschriftArtikelBegutachtung

Abstract

Critical infrastructure, such as water treatment facilities, largely relies on the effective functioning of industrial control systems (ICSs). Due to the wide adoption of high-speed network and digital infrastructure technologies, these systems are now highly interconnected not only to corporate networks but also to the public Internet, mostly for remote control and monitoring purposes. Sophisticated cyber-attacks may take advantage the increased interconnectedness or other security gaps of an ICS and infiltrate the system with devastating consequences to the economy, national security, and even human life. Due to the paramount importance of detecting and isolating these attacks, we propose an unsupervised anomaly detection approach that employs causal inference to construct a robust anomaly score in two phases. First, minimal domain knowledge via causal models helps identify critical interdependencies in the system, while univariate models contribute to individually learn the normal behavior of the system’s components. In the final phase, we employ the extreme studentized deviate (ESD) on the computed score to detect attacks and to exclude any irrelevant sensor signals. Our approach is validated on the widely used Secure Water Treatment (SWaT) benchmark, and it exhibits the highest F1 score with zero false alarms, which is extremely important for real-world deployment.

Originalspracheenglisch
Aufsatznummer257
FachzeitschriftSensors
Jahrgang23
Ausgabenummer1
Frühes Online-Datum27 Dez. 2022
DOIs
PublikationsstatusVeröffentlicht - Jan. 2023

ASJC Scopus subject areas

  • Analytische Chemie
  • Information systems
  • Instrumentierung
  • Atom- und Molekularphysik sowie Optik
  • Elektrotechnik und Elektronik
  • Biochemie

Fingerprint

Untersuchen Sie die Forschungsthemen von „A Causality-Inspired Approach for Anomaly Detection in a Water Treatment Testbed“. Zusammen bilden sie einen einzigartigen Fingerprint.

Dieses zitieren