Detecting Cyber Attacks in Industrial Control Systems Using Spatio-Temporal Autoencoder

Industrial control systems (ICSs) are widely used in various industries. These systems have become prime targets for cyber and physical attacks. The attacks, which have an impact on the physical processes of an ICS, often lead to system misbehaviors through data contamination. Recent research has shown that network-based detection methods cannot monitor the physical level activities well enough to mitigate hybrid cyber attacks and cannot entirely protect ICSs. To protect ICSs from such threats, we propose a Spatio-Temporal Autoencoder (STA) with a Dynamic Thresholding Mechanism. The STA learns the normal physical behaviors of the system by capturing deep spatio-temporal dependencies to form a unified representation of the system state. The unified representation is decoded to reconstruct the input features. Then, the dynamic threshold is used to detect and locate the anomalies. We validate the STA using data set from a real water treatment plant testbed, SWaT. Evaluation results indicate the superior performance of the STA compared with six state-of-the-art methods, achieving an average improvement of 5.8% in the F-Score.