Industrial Cyber–Physical System Defense Resource Allocation Using Distributed Anomaly Detection

An industrial cyber–physical system (ICPS) tightly integrating both physical processes and information and communication technologies (ICTs) leads to increasing cyberspace threats and attacks for the critical electrical infrastructure. With the limited defense resources availability, the efficient threat perception and mitigation of potential impacts of cyber attacks are essential to enhance the ICPS operational security. This article proposes an optimal defense resource allocation solution to prioritize the ICPS asset protection based on the distributed network traffic anomaly detection. The traffic anomalies and attack paths can be timely detected simultaneously over multiple security zones of the electrical infrastructure through local computing devices. The defense resource allocation is formulated as a multiobjective optimization (MOO) problem considering the tradeoff among the asset vulnerability, cost, and criticality, and solved by the Pareto optimal solution generation approach. The proposed solution is extensively evaluated using a realistic electrical CPS (ECPS) testbed for a range of cyber-attack scenarios. The numerical results confirm the effectiveness of the proposed distributed anomaly detection model and defense resource allocation strategy for varying defense resource availabilities.

I. Introduction

The increasing integration of the state-of-the-art information and communication technologies (ICTs) in the processes of current industrial control systems (ICSs), e.g., the power generation systems, gas pipeline systems, and urban railway transportation systems, leads to the emergence of industrial cyber–physical system (ICPS) [1]. However, this brings about direct challenges to the safe and reliable operation of the industrial processes due to the threats and attacks from the cyberspace. Different forms of attacks are available in the current ICPS, including reconnaissance (e.g., port scanning and address sweeps), DDoS attack (e.g., TCP/UDP flooding and SYN flooding), spoofing attack (e.g., ARP spoofing and ICMP Smurf), and other attacks (e.g., replay attack, packet tampering, false data injection, and 0-day attack). These attacks are dedicated to causing network anomaly (e.g., information interception, privilege escalation, and remote control) that leads to disastrous physical damages [2].