Detection of Cyberattacks in Industrial Control Systems Using Enhanced Principal Component Analysis and Hypergraph-Based Convolution Neural Network (EPCA-HG-CNN)

The automated operations of industrial control systems (ICSs) highly rely on the interconnected devices, sensors, and actuators that are monitored and controlled by the supervisory control and data acquisition (SCADA) systems. Despite the numerous benefits of unifying the networking technologies with SCADA systems, ICSs are more susceptible to cyberattacks that can disrupt the secure operations of the critical infrastructures. Thus, the design and development of an efficient attack detection approach has become a complex task. Hence, this research work presents a novel hypergraph-based anomaly detection technique with enhanced principal component analysis and convolution neural network (EPCA-HG-CNN) to detect deviant behaviors of such systems. The proposed EPCA-HG-CNN algorithm involves two phases: 1) dimensionality reduction using enhanced PCA and 2) anomaly detection with HG-based CNN. Furthermore, the performance of EPCA-HG-CNN is evaluated with Singapore University of Technology and Design secure water treatment system and the experimental results show that the proposed EPCA-HG-CNN has identified anomalous behavior of the data with high detection rate, low false positives, and better classification accuracy.

I. Introduction

Industrial control systems are equipped with supervisory control and data acquisition (SCADA), programmable logic controllers (PLCs), remote terminal units, and industrial automation and control systems [1]. These physical components manage data collection and control the functions of industrial control system (ICS). The major function of ICS is to monitor and control the automated operations of critical infrastructures (CIs) like water distributed systems (WDS), power systems, and oil refineries. The increasing advancements in ICS have made these systems more vulnerable to cyberattacks. Intruding the control of ICS can paralyze the operations of CIs and cause economic damage to the entire infrastructure [2].