Anomaly detection is becoming increasingly significant in industrial cyber security, and different machine-learning algorithms have been generally acknowledged as various effective intrusion detection engines to successfully identify cyber attacks. However, different machine-learning algorithms may exhibit their own detection effects even if they analyze the same feature samples. As a sequence, after developing one feature generation approach, the most effective and applicable detection engines should be desperately selected by comparing distinct properties of each machine-learning algorithm. Based on process control features generated by directed function transition diagrams, this paper introduces five different machine-learning algorithms as alternative detection engines to discuss their matching abilities. Furthermore, this paper not only describes some qualitative properties to compare their advantages and disadvantages, but also gives an in-depth and meticulous research on their detection accuracies and consuming time. In the verified experiments, two attack models and four different attack intensities are defined to facilitate all quantitative comparisons, and the impacts of detection accuracy caused by the feature parameter are also comparatively analyzed. All experimental results can clearly explain that SVM (Support Vector Machine) and WNN (Wavelet Neural Network) are suggested as two applicable detection engines under differing cases. 

https://www.techscience.com/cmc/v73n2/48436/pdf

Compared Insights on Machine-Learning Anomaly Detection for Process Control Feature

Stealthy attack detection method based on Multi-feature long short-term memory prediction model

Case Optimization Using Improved Genetic Algorithm for Industrial Fuzzing Test

Deep Edge Defense for Industrial Internet Based on Customized Hardware and UOS Architecture

Due to the deep integration of information technology and operational technology, networked control systems are experiencing an increasing risk of international cyber attacks In practice, industrial cyber security is a significant topic because current networked control systems are supporting various critical infrastructures to offer vital utility services By comparing with traditional IT systems, this paper first analyzes the uncontrollable cyber threats and classified attack characteristics, and elaborates the intrinsic vulnerabilities in current networked control systems and novel security challenges in future Industrial Internet After that, in order to overcome partial vulnerabilities, this paper presents a few representative security mechanisms which have been successfully applied in today's industrial control systems, and these mechanisms originally improve traditional IT defense technologies from the perspective of industrial availability Finally, several popular security viewpoints, adequately covering the needs of industrial network structures and service characteristics, are proposed to combine with burgeoning industrial information technologies We target to provide some helpful security guidelines for both academia and industry, and hope that our insights can further promote in-depth development of industrial cyber security

Jiushuang Wang

Papers

Characteristic insights on industrial cyber security and popular defense mechanisms