Madics: A methodology for anomaly detection in industrial control systems

Perales Gómez, Ángel Luis; Fernández Maimó, Lorenzo; García Clemente, Félix J.; Huertas Celdrán, Alberto

Publication:
Madics: A methodology for anomaly detection in industrial control systems

dc.contributor.author	Perales Gómez, Ángel Luis
dc.contributor.author	Fernández Maimó, Lorenzo
dc.contributor.author	García Clemente, Félix J.
dc.contributor.author	Huertas Celdrán, Alberto
dc.contributor.department	Ingeniería y Tecnología de Computadores
dc.date.accessioned	2024-06-28T07:54:58Z
dc.date.available	2024-06-28T07:54:58Z
dc.date.issued	2020-09-23
dc.description	© 2020. The authors. This document is made available under the CC-BY-SA 4.0 license http://creativecommons.org/licenses/by-sa /4.0/ This document is the published version of a published work that appeared in final form in Symmetry. To access the final work, see DOI: https://doi.org/10.3390/sym12101583
dc.description.abstract	Industrial Control Systems (ICSs) are widely used in critical infrastructures to support the essential services of society. Therefore, their protection against terrorist activities, natural disasters, and cyber threats is critical. Diverse cyber attack detection systems have been proposed over the years, in which each proposal has applied different steps and methods. However, there is a significant gap in the literature regarding methodologies to detect cyber attacks in ICS scenarios. The lack of such methodologies prevents researchers from being able to accurately compare proposals and results. In this work, we present a Methodology for Anomaly Detection in Industrial Control Systems (MADICS) to detect cyber attacks in ICS scenarios, which is intended to provide a guideline for future works in the field. MADICS is based on a semi-supervised anomaly detection paradigm and makes use of deep learning algorithms to model ICS behaviors. It consists of five main steps, focused on pre-processing the dataset to be used with the machine learning and deep learning algorithms; performing feature filtering to remove those features that do not meet the requirements; feature extraction processes to obtain higher order features; selecting, fine-tuning, and training the most appropriate model; and validating the model performance. In order to validate MADICS, we used the popular Secure Water Treatment (SWaT) dataset, which was collected from a fully operational water treatment plant. The experiments demonstrate that, using MADICS, we can achieve a state-of-the-art precision of 0.984 (as well as a recall of 0.750 and F1-score of 0.851), which is above the average of other works, proving that the proposed methodology is suitable for use in real ICS scenarios.	es
dc.format	application/pdf	es
dc.identifier.citation	Symmetry 2020, 12(10), 1583
dc.identifier.doi	https://doi.org/10.3390/sym12101583
dc.identifier.uri	http://hdl.handle.net/10201/142751
dc.language	eng	es
dc.publisher	MDPI
dc.relation	This work was funded by Spanish Ministry of Science, Innovation and Universities, FEDER funds, under Grant RTI2018-095855-B-I00, and the Government of Ireland, through the IRC post-doc fellowship (Grant Code GOIPD/2018/466).	es
dc.relation.publisherversion	https://www.mdpi.com/2073-8994/12/10/1583
dc.rights	info:eu-repo/semantics/openAccess	es
dc.rights	Atribución-CompartirIgual 4.0 Internacional	*
dc.rights.uri	http://creativecommons.org/licenses/by-sa/4.0/	*
dc.title	Madics: A methodology for anomaly detection in industrial control systems	es
dc.type	info:eu-repo/semantics/article	es
dspace.entity.type	Publication	es
relation.isAuthorOfPublication	155e7fdb-63ef-47a4-8068-bc025cfbabb9
relation.isAuthorOfPublication.latestForDiscovery	155e7fdb-63ef-47a4-8068-bc025cfbabb9