Pairwise Anomaly Detection for Industrial Control Systems
Ermiyas Birihanu, Souad Asroubi, Imre Lendák · 2024
Industrial Control Systems (ICS) manage critical infrastructure like power plants and water systems. As they become more complex and interconnected, they face increasing cyber threats. Traditional anomaly detection methods often fail due to the dynamic and noisy nature of ICS. This study proposes an effective anomaly detection approach for ICS by integrating Dynamic Time Warping (DTW) with machine learning methods through pairwise similarity analysis. The approach begins with selecting relevant sensor features from ICS data to monitor system behavior over time. Next, the optimal window size for segmenting data sequences is determined to accurately capture significant changes in the sensor data. Pairwise DTW distances between sensor features are then calculated within these windows, allowing for the comparison of sequences even when timing differences exist. These distances are subsequently utilized to en-hance the performance and interpretability of machine learning models. Setting an ideal threshold is crucial in anomaly detection to effectively balance the identification of true anomalies while minimizing false positives. To achieve this, we used the AUC (Area Under the Curve) to pinpoint the threshold that maximizes the F1 score, ensuring a good balance between precision and recall. The effectiveness of the proposed method is evaluated using datasets from Secure Water Treatment (SWaT) and HIL-based Augmented ICS Security (HIL-HAI). The Pairwise DTW LSTM model demonstrated strong performance, achieving 89% recall. 93% F1-score. and 92% AUC.