Anomaly detection system based on deep learning for cyber physical systems on sensory and network datasets

Abstract

Cyber-physical systems (CPSs), a type of computing system integrated with physical devices, are widely used in many areas such as manufacturing, traffic control, and energy. The integration of CPS and networks has expanded the range of cyber threats. Intrusion detection systems (IDSs), use signature based and machine learning based techniques to protect networks, against threats in CPSs. Water purifying plants are among the important CPSs. In this context some research uses a dataset obtained from secure water treatment (SWaT) an operational water treatment testbed. These works usually focus solely on sensory dataset and omit the analysis of network dataset, or they focus on network information and omit sensory data. In this paper we work on both datasets. We have created IDSs using five traditional machine learning techniques, decision tree, support vector machine (SVM), random forest, naïve Bayes, and artificial neural network along with two deep methods, deep neural network, and convolutional neural network. We experimented with IDSs, on three different datasets obtained from SWaT, including network data, sensory data, and Modbus data. The accuracies of proposed methods show higher values on all datasets especially on sensory (99.9%) and Modbus data (95%) and superiority of random forest and deep learning methods compared to others.