Comparative Analysis of the Clustering Methods Application for Detecting Anomalies in the Information Processes of ICS Networks Exposed to Cyberattacks

The rise of industrial automation tools and the integration of industrial and corporate networks for better production management have increased the likelihood of successful cyberattacks. This has necessitated the need to address the practical information security of industrial control systems (ICS). One solution is anomaly detection in ICS information processes during operation, which can detect known and unknown cyberattacks without prior analysis or labeling of training samples. Cluster analysis is used as an anomaly detection method in ICS, with hierarchical cluster analysis applied to data exposed to various cyberattacks. The study solves the issue of determining the optimal methods for secondary analysis of hierarchical clusters in order to mark clusters that includes anomalous data. Different methods such as IsoTree, OPTICS, LOF and ECOD were considered. Among these methods of classification and clustering, IsoTree and LOF methods provided the best results for the
$SWaT$
dataset for determining clusters both anomalous and normal.