Anomaly Detection for the Industrial Control Systems: A Hybrid Deep Learning Approach
摘要
Industrial Control Systems (ICS) are complex networks that coordinate critical infrastructures, such as electricity, gas, water, and transportation. Initially, ICS were isolated from the Internet. However, with advancements in Internet technology and a growing need for data sharing with other systems, Internet connectivity has become essential. This increased connectivity, combined with various industrial protocols, has led to more frequent and complex cyber-attacks on ICS. Such attacks can disrupt digital systems and may even cause failures in physical equipment, resulting in cyber-physical attacks. The goal of this study is to propose a hybrid approach to anomaly detection using deep learning approaches, evaluated through Root Mean Square Error (RMSE), Mean Square Error (MSE), and Mean Absolute Error (MAE) metrics for regression problems. Statistical methods were employed to determine anomaly thresholds, with model performance assessed via precision and recall. The combined LSTM + GRU and Bi-LSTM + Bi-GRU models demonstrated lower RMSE, MSE, and MAE. Tested on the Secure Water Treatment (SWaT) dataset, the combined model detected 35 out of 36 attacks, outperforming individual models (LSTM: 33, GRU: 34). This research enhances model performance through deep learning integration, hyperparameter tuning, and point anomaly detection in the ICS domain.