False Data Injection Attack Testbed of Industrial Cyber-Physical Systems of Process Industry and A Detection Application

False data injection (FDI) attack is a common and destructive attack method in Industrial Cyber-Physical Systems (ICPSs), which is mounted in the cyber layer, compromises the measurement data and interferes the physical system at last, especially in the process industry and smart grid. In response, researchers developed many detection method rely on simulation, but the real situations are not ideal simulation environment. This leads to situation in which the high-level methods cannot applied to industrial sites directly. In this paper, we design a testbed of process industry, which is a hardware-in-the-loop platform, to simulate the real industrial production and applied a FDI attack on the platform. The physical process is simulated by a host, and the cyber items are real industrial controller or engineer station. Next, we design an efficient FDI attack detection method, DRIF. Based on our proposed framework, the optimal potential features of high-dimensional industrial process data can be fully extracted, which is conducive to the stage of accurate detection. In addition, it makes our proposed method practicable in real-world scenarios where data instances in normal condition can be used for model training only. The proposed method is applied on the designed platform, and the promising case studies show our framework can achieve satisfactory detection performance, which sheds light on the industrial security to some extent.

I. Introduction

Industrial Cyber-Physical Systems (ICPSs) are highly complex systems with comprehensive computing, cyberspace, and physical process [1]. Through computation, communication, and control (3C), the original isolated industrial manufacturing systems can be upgraded by powerful engineering techniques and tools such as pattern recognition [2], optimization [3], prediction control [4], machine learning [5], etc. However, to make production more efficient, these powerful techniques usually collect data from physical processes to train their high-level model. Therefore, the originally isolated plants are needed to connect to the external network, and due to the limited resources (energy, expenditure, and bandwidth) and remote unattended operation, these nearly semi-open systems are easily suffering widely cyber-attacks [6], [7], such as the “Sapphire Worm” virus in the United States in 2003 [8], the “Stuxnet” virus in Iran in 2010 [9] and the world-shaking blackout in Ukraine in 2015 [10].