Enhancing Industrial Control Systems Security: Real-Time Anomaly Detection with Uncertainty Estimation
摘要
Industrial Control Systems (ICS) are crucial for managing essential infrastructure like energy, healthcare, and water treatment. However, as ICS become increasingly complex and interconnected with more edge devices, they become more difficult to manage and vulnerable to new threats. The objective of this study is to proposed a real-time anomaly detection framework and assess the uncertainty associated with the proposed method. An anomaly detection framework for ICS data streams is used, employing Docker containers for scalable and manageable model deployment. Three machine learning models: Autoencoder (AE), LSTM Autoencoder (LSTM-AE), and Seq to Seq (Seq2Seq) were trained on the Secure Water Treatment (SWaT) and HIL- based Augmented ICS security (HAI) datasets to detect anomalies based on reconstruction error deviations. To enhance detection accuracy and assess prediction confidence, Monte Carlo (MC) Dropout and Bayesian Neural Networks (BNNs) were employed. This approach reduces false positives and enables adaptive thresholding for more focused investigations and faster responses to critical anomalies. The results indicate that the proposed models effectively learn normal patterns and accurately detect anomalies. The AE model provided consistent predictions with moderate uncertainty, while the LSTM-AE and Seq2Seq models successfully captured time-based patterns with varying confidence levels. This study highlights that integrating anomaly detection with uncertainty estimation enhances ICS reliability and security by measuring prediction confidence, preventing failures, and supporting resilient industrial processes. Our code is publicly available: https://github.com/Ermiyas21/Realtime-Anomaly-detection-for-ICS .