Data Integrity of Industrial Controllers via Multi-resolution Hierarchical Time Series Clustering
Andrew Walker, Joydeep Acharya · 2019
Industrial controllers operate vital machinery and must always ensure reliability. This can be compromised during cyber-physical security breaches where the controller data fails to report the true machine status. In this paper, we develop a solution to estimate true machine status based on (uncompromised) external sensor data. This is a hard problem to solve as industrial machine behavior is dictated by multiple hidden underlying states with no direct physical interpretation. However, identification of these states will simplify monitoring of controller data, since the data could be expected to be more regular within a particular state. Accordingly, we solve two problems: We first propose a new multi-resolution, hierarchical clustering algorithm to identify the machine states. Our algorithm is an extension of the Toeplitz Inverse Covariance-based Clustering (TICC) introduced by Hallac et al., which we call Hierarchical TICC. It involves two new hyperparameters, but removes the need to specify the number of clusters in advance. Next we show that within a known state, data taken from sensors can be leveraged to produce an effective classifier of controller data. Tested on data from a controlled manufacturing testbed, we show that Hierarchical TICC, when applied to current and vibration sensor data, was able to recover almost the same clusters (97% in agreement) as TICC, but gives the flexibility of not having to provide the number of clusters in advance. Subsequent classification within a cluster is also capable of learning data reported by the controllers of those machines with accuracy generally above 90%.