Detecting Cyber Attacks in Industrial Control Systems Using Duration-aware Representation Learning
Bin Lan, Shun‐Zheng Yu · 2024
Industrial Control Systems (ICSs) are critical mission systems that are essential to industry and society. As ICSs become more digitized, networked, and intelligent, they have become attractive targets for both physical and cyber attacks. In this paper, we propose a novel AutoEncoder (AE) model based on Explicit Duration Recurrent Network (EDRN) and Spatial Attention. The model is applied to learn the duration distribution of hidden states that govern an ICS process, the varying periods embedded in input sequences, and deep spatio-temporal dependencies among devices in ICS. Additionally, we incorporate a dynamic threshold mechanism to evaluate the presence of anomalous behavior in the physical system. This mechanism facilitates anomalous location and analysis, and enables sensitivity adjustment. Finally, we conducted experiments on a real ICS testbed, SWaT, and compared our method with six state-of-the-art methods, demonstrating the effectiveness of EDRN and the superior detection performance of the proposed method.