This paper presents a study on detecting cyberattacks on industrial control systems (ICS) using unsupervised deep neural networks, specifically, convolutional neural networks. The study was performed on a SecureWater Treatment testbed (SWaT) dataset, which represents a scaled-down version of a real-world industrial water treatment plant. e suggest a method for anomaly detection based on measuring the statistical deviation of the predicted value from the observed value.We applied the proposed method by using a variety of deep neural networks architectures including different variants of convolutional and recurrent networks. The test dataset from SWaT included 36 different cyberattacks. The proposed method successfully detects the vast majority of the attacks with a low false positive rate thus improving on previous works based on this data set. The results of the study show that 1D convolutional networks can be successfully applied to anomaly detection in industrial control systems and outperform more complex recurrent networks while being much smaller and faster to train.
Multiple machine learning techniques are used in ICS anomaly detection. They include support-vector machine @cite_5 @cite_19 , random forest @cite_33 as well as artificial neural network @cite_22 , @cite_29 and others. In the past few years some research has been performed applying deep and recurrent neural networks to this area @cite_35 , @cite_3 , @cite_41 . In our research 1D convolutional neural networks (1D CNNs) are used, and demonstrate superior attack detection abilities and higher @math scores than previously published papers @cite_3 , @cite_41 . Previously, 1D CNNs were used for detecting faulty motor bearings based on univariant motor current data @cite_21 . In this study we apply 1D CNNs to multivariant time series data and use it to detect multiple instances of cyberattacks. To the best of our knowledge, our work is the first to use 1D CNNs for cyberattacks detection in ICSs.
@cite_35 @cite_22 @cite_33 @cite_41 @cite_29 @cite_21 @cite_3 @cite_19 @cite_5
2750784772 2504335775 1516595210 2040890927
Despite significant accuracy improvement in convolutional neural networks (CNN) based object detectors, they often require prohibitive runtimes to process an image for real-time applications. State-of-the-art models often use very deep networks with a large number of floating point operations. Efforts such as model compression learn compact models with fewer number of parameters, but with much reduced accuracy. In this work, we propose a new framework to learn compact and fast object detection networks with improved accuracy using knowledge distillation [20] and hint learning [34]. Although knowledge distillation has demonstrated excellent improvements for simpler classification setups, the complexity of detection poses new challenges in the form of regression, region proposals and less voluminous labels. We address this through several innovations such as a weighted cross-entropy loss to address class imbalance, a teacher bounded loss to handle the regression component and adaptation layers to better learn from intermediate teacher distributions. We conduct comprehensive empirical evaluation with different distillation configurations over multiple datasets including PASCAL, KITTI, ILSVRC and MS-COCO. Our results show consistent improvement in accuracy-speed trade-offs for modern multi-class detection models. In present object detection systems, the deep convolutional neural networks (CNNs) are utilized to predict bounding boxes of object candidates, and have gained performance advantages over the traditional region proposal methods. However, existing deep CNN methods assume the object bounds to be four independent variables, which could be regressed by the l2 loss separately. Such an oversimplified assumption is contrary to the well-received observation, that those variables are correlated, resulting to less accurate localization. To address the issue, we firstly introduce a novel Intersection over Union (IoU) loss function for bounding box prediction, which regresses the four bounds of a predicted box as a whole unit. By taking the advantages of IoU loss and deep fully convolutional networks, the UnitBox is introduced, which performs accurate and efficient localization, shows robust to objects of varied shapes and scales, and converges fast. We apply UnitBox on face detection task and achieve the best performance among all published methods on the FDDB benchmark. Convolutional neural networks (CNNs) have emerged as the most powerful technique for a range of different tasks in computer vision. Recent work suggested that CNN features are generic and can be used for classification tasks outside the exact domain for which the networks were trained. In this work we use the features from one such network, OverFeat, trained for object detection in natural images, for nodule detection in computed tomography scans. We use 865 scans from the publicly available LIDC data set, read by four thoracic radiologists. Nodule candidates are generated by a state-of-the-art nodule detection system. We extract 2D sagittal, coronal and axial patches for each nodule candidate and extract 4096 features from the penultimate layer of OverFeat and classify these with linear support vector machines. We show for various configurations that the off-the-shelf CNN features perform surprisingly well, but not as good as the dedicated detection system. When both approaches are combined, significantly better results are obtained than either approach alone. We conclude that CNN features have great potential to be used for detection tasks in volumetric medical data. An anomaly intrusion detection approach based on Hybrid MLP CNN (Multi-layer Perceptron Chaotic Neural Network) neural network is proposed in this paper. Most anomaly detection approaches using MLP can detecting novel real-time attacks, but still have high false alarm rates. Most attacks are composed of a series of anomaly events. These attacks are called timedelayed attacks, which current neural network IDSs (Intrusion Detection System) cannot identify efficiently. A hybrid MLP CNN neural network is constructed in order to improve the detection rate of time-delayed attacks. While obtaining a similarly detection rate of real-time attacks as the MLP does, the proposed approach can detect time-delayed attacks efficiently with chaotic neuron. This approach also exhibits a lower false alarm rate when detects novel attacks. The simulation tests are conducted using DARPA 1998 dataset. The experimental results are presented and compared in ROC curves, which can demonstrate that the proposed approach performs exceptionally in terms of both detection rate and false alarm rate.