ECADA: An Edge Computing Assisted Delay-Aware Anomaly Detection Scheme for ICS

Today, with more and more devices in the industrial control system (ICS), the risk becomes higher and brings more attack surfaces. The need for reliable anomaly detection systems is increasing. Traditional SCADA-based detection systems deployed are difficult to assess large-scale control systems accurately, and novel AI-based technologies struggle to ensure timely response. In this paper, we propose an edge computing assisted delay-aware anomaly detection (ECADA) scheme for ICS, which considers both the accuracy and timeliness, and ensures that abnormal conditions can be accurately detected and handled in a short time. First, we model the components in ICS as three layers, taking network resources, delay, and reliability into consideration. Second, we convert the anomaly detection procedure into a decision making problem. By dividing the warning capabilities into various levels, the flexibility of the anomaly detection system is enhanced. Third, we cast a mixed-integer linear programming (MILP) problem to find the efficient anomaly detection mechanism, so that it can be dynamically scheduled to achieve the tradeoff between reliability and timeliness. We use an real-world industrial system dataset for experimental evaluation. By comparing with various traditional anomaly detection methods, it is proved that ECADA can always ensure reliable response of anomaly detection system in various network environments.