Visible to the public An Improved Industrial Control System Device Logs Processing Method for Process-Based Anomaly Detection

TitleAn Improved Industrial Control System Device Logs Processing Method for Process-Based Anomaly Detection
Publication TypeConference Paper
Year of Publication2019
AuthorsHussain, Mukhtar, Foo, Ernest, Suriadi, Suriadi
Conference Name2019 International Conference on Frontiers of Information Technology (FIT)
Date PublishedDec. 2019
ISBN Number978-1-7281-6625-4
Keywordsanomalous behaviour, anomaly detection, cyber-attacks, event logs, event-driven system analysis, expected behaviour, formalised method, ICs, ICS device, improved industrial control system device logs processing method, industrial control, industrial control system, industrial control systems, industrial process, intrusion detection system, Petri Net model identification, Petri nets, PN identification-based anomaly detection methods, process-based anomaly detection, process-based attacks, process-related attacks, pubcrawl, resilience, Resiliency, Scalability, security of data, System Identification, system monitoring

Detecting process-based attacks on industrial control systems (ICS) is challenging. These cyber-attacks are designed to disrupt the industrial process by changing the state of a system, while keeping the system's behaviour close to the expected behaviour. Such anomalous behaviour can be effectively detected by an event-driven approach. Petri Net (PN) model identification has proved to be an effective method for event-driven system analysis and anomaly detection. However, PN identification-based anomaly detection methods require ICS device logs to be converted into event logs (sequence of events). Therefore, in this paper we present a formalised method for pre-processing and transforming ICS device logs into event logs. The proposed approach outperforms the previous methods of device logs processing in terms of anomaly detection. We have demonstrated the results using two published datasets.

Citation Keyhussain_improved_2019