Distributed Real-Time Anomaly Detection in Networked Industrial Sensing Systems

WSNs (Wireless Sensor Networks) have been considered one of the very promising technologies for the implementation of smart grid. And security of WSNs becomes a central concern. The security solutions for generic wireless sensor networks cannot be directly used in smart grid WSNs. In this paper, the applications of sensor networks in electric power systems are discussed and analyzed first. Then, the characteristics of smart grid WSNs are summarized. Threats and security requirements special for wireless sensor networks used in smart grid systems are presented. Based on these works, reference security architecture was proposed to guide the development and the design of the security solutions of wireless sensor networks in smart grid systems, considering the information security requirements of electric power systems. Moreover, open security issues needed solve to protect WSNs applied in smart grid, and research challenges are introduced.

Wireless sensor networks (WSNs) receive considerable attention as one of the key and enabling technologies of cyber-physical systems (CPSs) that, in turn, present a new computing paradigm now and into the future. WSNs are open to a wide range of potential applications, such as environmental monitoring, human health monitoring, target detection and tracking, and industrial process control. To be smart and highly efficient services are the present and future demand of WSNs. In this chapter, we aim to introduce the fundamentals of an intelligent wireless sensor network (iWSN) and its requisites, characteristics, and applications. Also, we distinguish between the traditional WSN and the iWSN. First, the definition and properties of an intelligent system are described. Then we explain how a WSN can be deployed in a cyber-physical system and provide the facility for communications among different components of the system. In the next sections, various characteristics of an iWSN, its applications, and comparison to WSN are highlighted. Two applications of WSN, comprising smart grid and smart field monitoring system for pest control, will be introduced and compared in terms of the features of intelligence they require.

The smart grid system is composed of the power infrastructure and communication infrastructure and thus is characterized by the flow of electric power and information, respectively. Although there is no doubt that the wireless communication architecture will play a significant role in smart grid, the wireless network introduces additional vulnerabilities, given the scale of potential threats. Therefore, the physical layer security issue is of first priority in the study of smart grid and has already attracted substantial attention in the industry and academia. In this paper, we aimed to present a general overview of the physical layer security in wireless smart grid and cover the effective countermeasures proposed in the literature of smart grid to date. We first investigate the security challenges from malicious attacks. Specifically, two typical forms of malicious attack in smart grid, namely, jamming and bad data injecting, are studied. In addition, the related countermeasures against these malicious attacks are illustrated. Further, we analyze the state of the art of the privacy issues in smart grid. The private information and privacy concerns are introduced, and then the effective solutions to privacy security are provided. Finally, voltage regulation, a security topic that has been hardly studied in the wireless smart grid domain, is presented. We expect that the work presented here will advance the research on smart grid security. Copyright © 2013 John Wiley & Sons, Ltd.

As a major form of data, the collection and analysis of time series have been widely used in many fields. In practice, wireless sensor network is a popular mechanism for data collection and it is suitable for time series. However, due to the diversity deployment area for a wireless sensor network, the external environmental factors pose a great challenge on the quality of data collected by a sensor node. Besides, the accuracy and reliability of collected data are also affected by internal factors of a sensor node and the performance of the whole wireless sensor network. Common internal factors are resource limitation such as battery capacity, computing ability, and memory size. Moreover, a wireless sensor network deployed for production use is very likely to suffer from malicious attacks from both inside and outside. Therefore, anomaly is inevitable for time series collected by a wireless sensor network. In the paper, we make an extensive review about two types of anomaly detection methods in time series for wireless sensor networks: outlier detection and pattern anomaly detection. For outlier detection, six categories of detection methods are elaborated. For pattern anomaly detection, two main ideas are discussed. Finally, we present the main drawbacks of existing approaches to outlier detection and pattern anomaly detection for time series. The possible future research directions are also summarized.

Wireless sensor and actuator networks (WSANs) are heterogeneous networks composed of many different nodes that can cooperatively sense the environment, determine an appropriate action to take, then change the environment’s state after acting on it. As a natural extension of wireless sensor networks (WSNs), WSANs inherit from them a variety of research challenges and bring forth many new ones. These challenges are related to dealing with imprecise and vague information, solving complicated optimization problems or collecting and processing data from multiple sources. Computational intelligence (CI) is an overarching term denoting a conglomerate of biologically and linguistically inspired techniques that provide robust solutions to NP-hard problems, reason in imprecise terms and yield high-quality yet computationally tractable approximate solutions to real-world problems. Many researchers have consequently turned to CI in hope of finding answers to a plethora of WSAN-related challenges. This paper reviews the application of several methodologies under the CI umbrella to the WSAN field. We describe and categorize existing works leaning on fuzzy systems , neural networks , evolutionary computation , swarm intelligence , learning systems , and their hybridizations to well-known or emerging WSAN problems along five major axes: 1) actuation; 2) communication; 3) sink mobility; 4) topology control; and 5) localization. The survey offers informative discussions to help reason through all the studies under consideration. Finally, we point to future research avenues by: 1) suggesting suitable CI techniques to specific problems; 2) borrowing concepts from WSNs that have yet to be applied to WSANs; or 3) describing the shortcomings of current methods in order to spark interest on the development of more refined models.

This paper is focused on the event-based secure control issue for cyber-physical systems (CPSs) under aperiodic denial-of-service (DoS) attacks. Malicious DoS attacks disrupt the communication between the controller and the actuator. The finite attack resources of malicious attackers are taken into consideration, and the DoS attacks are characterized using an aperiodic model. In contrast to prior results, the present study tackles the issue of secure controller design by considering the attributes of the DoS attack, instead of employing a switched system approach to address the aforementioned concerns. More specifically, under aperiodic DoS attacks, sufficient criteria are established to guarantee that the closed-loop CPSs can achieve bounded stability. Then, within a time-varying attack period, the relationship between the attack active interval and the attack silent interval is derived. Without satisfying the derived conditions, the system’s stability will deteriorate. Moreover, an event-based secure control scheme under aperiodic DoS attacks is designed. To verify the efficacy of the derived theory, a wheeled mobile robot system under aperiodic DoS attacks is illustrated. Note to Practitioners—CPSs have been widely utilized in various domains, such as aerospace and intelligent transportation. However, the openness of networks provides attackers with numerous opportunities for malicious assaults, consequently leading to a degradation in system performance. Consequently, researching the security issues of CPSs under malicious attacks is of utmost urgency. This paper focuses on the issue of event-triggered secure control for CPSs in the presence of energy-constrained aperiodic DoS attacks. The event-triggered communication mechanism is introduced to reduce the computational burden. The criteria for ensuring the bounded stability of CPSs under aperiodic DoS attacks are proposed. The relationship between the attack active interval and the attack silent interval is derived, which is incorporated into the proposed criteria. A wheeled mobile robot system is given to validate the effectiveness of the proposed method. In the future, an active defense control method will be proposed to counter malicious attacks.

Smart Grid integrates digital processing, sensor technology, automatic control and communication to the traditional power grid to achieve more efficient electricity distribution and management. Applying wireless sensor networks (WSNs) to Smart Grid can greatly facilitate the real-time information exchange within the power management system, and enable fast adaptation of the system to environmental changes. However, there are many challenges that need to be addressed for applying WSNs to the Smart Grid. One critical issue is how to receive data at the controller's node in a timely manner considering the typically time sensitive environment in Smart Grid and the limited battery power supply in WSNs. Based on data classification, this paper proposes a data transmission strategy in WSNs. After appropriate processing while collecting those large and complex data during aggregation, they are classified into different priority levels according to their various features. This classification process ensures the most important data which occupy a quite small percent of the total amount. The proposed cognitive transmission measure can guarantee a minimum delay for the most key data under the constraints of the electric-power-system environment and battery power supply. We offer simulation results to show the performance of the proposed cognitive transmission scheme.

In wireless sensor networks (WSN), sensor nodes are expected to operate autonomously in a human inaccessible and the hostile environment for which the sensor nodes and communication links are therefore, prone to faults and potential malicious attacks. Sensor readings that differ significantly from the usual pattern of sensed data due to faults in sensor nodes, unreliable communication links, and physical and logical malicious attacks are considered as outliers. This paper presents an outlier detection technique based on deep learning namely, generative adversarial networks (GANs) with autoencoder neural network. The two-level architecture proposed for WSN makes the proposed technique robust. The simulation result indicates improvement in detection accuracy compared to existing state-of-the-art techniques applied for WSNs and increase of the network lifetime. Robustness of outlier detection algorithm with respect to channel fault and robustness concerning different types of distribution of faulty communication channel is analyzed.

Cyber-physical systems (CPS) are aimed at combining the physical system with the cyber ones to provide a better control and improve the management of physical systems around us. Recently, the CPS and its applications, e.g., health-care and smart grid, have gained attention of the research community. In this paper, we consider the privacy aspect of users in a CPS, particularly in smart grid system as our use-case, and provide a mechanism that utilizes the advances in network coding to maintain data privacy. We address privacy issues associated with gathering metering information of clients in a smart grid system. In smart grid systems, wireless multi-hop communications are mainly used to gather metering information through exchanging data and control messages between smart meters and the utility. We argue that any communication paradigm used in a smart grid should support all aspects of privacy such as anonymity, unlinkability, unobservablity, and undetectablity. We propose innovative schemes for traffic routing and encryption that benefit from the enhanced network coding technology. Our analysis shows that our schemes maintain privacy of users despite the possibility of detecting metering data by an adversary. In addition, our scheme has extra favorable features such as less computation complexity, reliable, and robust communication.

Frequency converters are used to control electric motors in many kinds of industrial applications. Since they control the electric motors that run the machines or processes, they must be strongly integrated with the rest of the automation system. If the wireless sensor and actuator networks are used as a part of the same automation system, it would be beneficial to have a direct connection between wireless sensor network and frequency converter instead of routing the information through several interfaces. To enable this, we built a software and hardware integration between frequency converter and wireless sensor network. Developed system was tested by performing several experiments in real industrial environment that consisted of sophisticated mobile machines. In the experiments, several frequency converters and sensor nodes were used in the same network. System performance and reliability was evaluated based on the experiment results, and some directions pointed for the future work.

The nature of wireless sensor networks (WSNs) makes them very vulnerable to adversary's malicious attacks. Therefore, network security is an important issue to WSNs. Due to the constraints of WSN, intrusion detection in WSNs is a challengeable task. In this paper, we present a novel intrusion detection mechanism for WSNs, which is composed of a secure data communication algorithm and an intrusion detection algorithm. The major contribution of this paper is that we propose an original secure mechanism to defend WSNs against malicious attacks by using the information generated during data communication. The approach is able to protect the data communication in a WSN even if some sensor nodes are compromised by adversary. The proposed approach is easy to be implemented and performed in resource-constrained WSN. We also evaluate the proposed approach by a simulation experiment and analyze the simulation results in detail.

The number of devices connected to the Internet is experiencing an explosive growth. The interconnection of smart objects embedded with sensors enables them to interact with the environment and among themselves, forming a Wireless Sensor Network (WSN). These network nodes perform acquisition, collection and analysis of data, such as temperature and soil moisture. Such data can be employed to automate the irrigation process in agriculture while decreasing water consumption, resulting in monetary and environmental benefits. The high storage and processing capabilities, the rapid elasticity and payper-use characteristics makes Cloud Computing an attractive solution to the large amount of data generated by the WSN. This paper proposes and evaluates on a real deployment a cloud-based Wireless Sensor and Actuator Network (WSAN) communication system. This solution monitors and controls a set of sensors and actuators, respectively, to assess plants water needs.

A wireless sensor network (WSN) is defined as a set of spatially distributed and interconnected sensor nodes. WSNs allow one to monitor and recognize environmental phenomena such as soil moisture, air pollution, and health data. Because of the very limited resources available in sensors, the collected data from WSNs are often characterized as unreliable or uncertain. However, applications using WSNs demand precise readings, and uncertainty in data reading can cause serious damage (e.g., health monitoring data). Therefore, an efficient local/distributed data processing algorithm is needed to ensure: (1) the extraction of precise and reliable values from noisy readings; (2) the detection of anomalies from data reported by sensors; and (3) the identification of outlier sensors in a WSN. Several works have been conducted to achieve these objectives using several techniques such as machine learning algorithms, mathematical modeling, and clustering. The purpose of this paper is to conduct a systematic literature review to report the available works on outlier and anomaly detection in WSNs. The paper highlights works conducted from January 2004 to October 2018. A total of 3520 papers are reviewed in the initial search process. Later, these papers are filtered by title, abstract, and contents, and a total of 117 papers are selected. These papers are examined to answer the defined research questions. The current paper presents an improved taxonomy of outlier detection techniques. This will help researchers and practitioners to find the most relevant and recent studies related to outlier detection in WSNs. Finally, the paper identifies existing gaps that future studies can fill.

Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

In recent years, with the development of the Internet of things industry, wireless sensor networks, as one of the most important technologies in its sensing layer, have been further studied and applied. However, the security threats it faces are becoming more and more diverse, and the security needs are becoming more and more urgent. However, wireless sensor network nodes are mutually exclusive, which leads to low accuracy of attack path prediction when malicious attacks occur. In order to ensure the security of wireless sensor networks, a hidden Markov based malicious attack path prediction method for wireless sensor networks is designed. The method of authentication coding is introduced to realize data integrity authentication. Extract the malicious software gene sequence, define the constraint conditions of the state transition probability matrix, build the attack means deduction model based on Hidden Markov, and realize the malicious attack path prediction. Experimental results: the average accuracy of the proposed method in four malicious attack scenarios is 73.583%, 55.674%, 32.923% and 85.014%, respectively. The results also verify that the proposed method improves the accuracy of malicious attack path prediction in wireless sensor networks based on Hidden Markov model and has good feasibility. It provides an important basis for wireless sensor network administrators to implement defense strategies in time.