
Security is a complex issue in critical infrastructure like industrial control systems (ICS) since its leakages cause critical damage. Protecting the ICS environment from external threats, cyber-attacks, and natural disasters is important. Various works have been done on anomaly detection in ICS, and it has been identified that these proposed approaches are the sole models associated with them. Although there is a research gap in anomaly detection methodologies because of their computational complexity. To overcome the research gap of high false positive rate (precision), accuracy, and computational complexity in the literature, the study presents an Improved autoencoder (ImpAE) anomaly detection methodology for anomaly detection in ICS. The proposed methodology is a deep learning-based model to build anomaly detectors that alarm the attacks affecting ICS security. This methodology follows a flexible and modular design that permits a group of numerous detectors to get suitable detection. To express the suitability of the proposed model, we implemented it on the Secure water testbed (SWat) dataset, which is collected from a working water treatment plant. Experimental work shows that by using ImpAE, gaining a precision of 0.993 and an accuracy of 96%, in comparision to the existing results in the literature. With precision and accuracy, we gained a recall of 0.673 and an F1-Score of 0.771, which is better than the average of the other works. The used dataset was attained from ITrust Center, Singapore University of Digital Science, reliable for anomaly detection in an ICS environment.
TA168, Control engineering systems. Automatic machinery (General), ICS, TJ212-225, deep learning, SWaT, Anomaly detection, security, Systems engineering
TA168, Control engineering systems. Automatic machinery (General), ICS, TJ212-225, deep learning, SWaT, Anomaly detection, security, Systems engineering
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 13 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Top 10% | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Top 10% | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Top 10% |
