RRCNN: Request Response-Based Convolutional Neural Network for ICS Network Traffic Anomaly Detection

Condition monitoring is essential to ensuring precision and reliability of multi-joint industrial robots. Fault diagnosis is an effective method to identify different types of faults, whereas the tremendous obstacle to applying this method to multi-joint industrial robots is the difficulty of collecting and labeling a substantial quantity of abnormal samples. In this paper, a vibration-based hybrid deep learning approach for anomaly detection of multi-joint industrial robots is proposed to address this problem. A condition monitoring system is established using fiber Bragg grating (FBG) sensors to monitor the vibration of a multi-joint industrial robot. Considering the insufficient vibration information in single-domain data, multi-domain data, including the time domain waveform, frequency spectrum, and time-frequency spectrum of the vibration signal, is used to provide more comprehensive vibration information. Furthermore, the one-dimensional convolutional neural network (CNN) and two-dimensional CNN architectures are designed to automatically extract the representative features from multi-domain data, and these representative features are fused and input into K-nearest neighbors (KNN) to detect the anomalies in robot joints. Only normal samples are used for the training process of the hybridization of CNN and KNN. The results in three experiments illustrate that the proposed anomaly detection method has the satisfactory capability to handle the anomaly detection problem of multi-joint industrial robots.

The need for detection, identification and prediction of anomalies emerged just a short time ago. This task brings multiple challenges that are mainly associated with recording and detection of novel attacks and influences. It draws attention of experts in network security and diagnostics of information and industrial systems. Detection of anomalies in dynamic dataflows largely determines the efficiency of management of computer network information security within information and industrial systems. At the same time, the technology of dynamic dataflow prediction is also very important for building systems intended to detect anomalies in data protection within industrial control systems. Any automated systems are based on available computer capabilities and advances in management theory, mathematical modeling and optimizations methods. Processes that occur in industrial automated systems and that are reflected in dataflows being observed constitute complex multi-component processes, thus making it more complicated to predict such processes. In this case, complex multi-component time series data should be predicted at different (short-term, medium-term and long-term) time scales. A neural network architecture matching the structure of the multi-component time series being predicted should be built for generating a multi-component prediction. It is proposed to decompose the complex multi-component time series into several basic components using the digital signal processing technology, i. e. to perform a preliminary structural analysis of multi-component time series within the observed range of all time series that reflect operation of the industrial control system. Separate predictions with different time horizon are formed for each basic component of the multi-component time series using the available neural network architecture and machine learning taking into account dynamic characteristics of the above components. Anomalies in the observed range of multiple time series that reflect operation of the industrial control system are detected (identified) through component-wise comparison of each component (resulted from the above preliminary digital processing) of any time series within the observed range of all time series, with each prediction of the relevant component of the above time series within the observed range of all time series. This approach that implies component-wise comparison will allow to detect anomalies within the range of observed time series of the industrial control system separately by their different dynamic characteristics, and thus will improve the efficiency of management of information security within information and industrial systems.

Critical industrial infrastructures are currently facing increasing cyberspace threats in their underlying information and communication systems. The advanced monitoring, control, and management functionalities of the industrial systems firmly rely on the reliable and secure operations of the industrial control system (ICS) network. This article characterizes the ICS network traffic and presents a scalable and efficient solution for real-time ICS network traffic anomaly detection, considering various forms of ICS anomaly events. The events due to the cyberattacks, malicious operating behaviors, and network anomalies can be effectively detected without sophisticated computational requirements and retrieval of communication protocols. The proposed hybrid statistical-machine learning model integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the abnormal traffic patterns with low false omission rates. The proposed solution is extensively evaluated at a realistic ICS cyber–physical system (CPS) testbed, and the numerical results confirm its high detection accuracy and low computational complexity. Note to Practitioners—This article was motivated by the challenge of real-time anomaly detection in industrial cyber–physical systems (CPSs). The existing industrial control system (ICS) network anomaly detection solutions are generally carried out based on a single model based on the historian database and cannot dynamically classify the abnormal conditions in a real-time fashion. A novel hybrid statistical-machine learning model is developed that integrates a seasonal autoregressive integration moving average (SARIMA)-based dynamic threshold model and a long short-term memory (LSTM) model to jointly identify the anomalous events through traffic pattern analysis. The proposed anomaly detection solution can efficiently provide accurate detection for cyberattacks, malicious operating behaviors, and network anomalies while meeting the real-time requirements of ICS networks. The proposed solution can be deployed in the realistic ICS CPSs, e.g., the power generation system, gas pipeline systems, and urban railway transportation systems. The preliminary numerical results obtained from the ICS-CPS testbed suggested that it can provide high detection accuracy with low computational complexity and, hence, can be adopted with minimal deployment hurdles.

The massive use of information technology has brought certain security risks to the industrial production process. In recent years, cyber-physical attacks against industrial control systems have occurred frequently. Anomaly detection technology is an essential technical means to ensure the safety of industrial control systems. Considering the shortcomings of traditional methods and to facilitate the timely analysis and location of anomalies, this study proposes a solution based on the deep learning method for industrial traffic anomaly detection and attack classification. We use a convolutional neural network deep learning representation model as the detection model. The original one-dimensional data are mapped using the feature mapping method to make them suitable for model processing. The deep learning method can automatically extract critical features and achieve accurate attack classification. We performed a model evaluation using real network attack data from a supervisory control and data acquisition (SCADA) system. The experimental results showed that the proposed method met the anomaly detection and attack classification needs of a SCADA system. The proposed method also promotes the application of deep learning methods in industrial anomaly detection.

Chemical oxygen demand (COD) is an important indicator of organic pollution in water. It plays a crucial role in assessing water quality and protecting the environment. The rapid and accurate detection of COD is essential for continuous water quality monitoring. Traditional methods are often time-consuming and require chemical reagents. To address these challenges, a novel approach based on a one-dimensional convolutional neural network (1D-CNN) combined with UV-vis spectroscopy is proposed. This method is efficient, fast, and reagent-free, offering significant advantages over conventional techniques. The proposed 1D-CNN method incorporates one-dimensional multi-scale feature fusion to enhance the accuracy of COD detection. The method improves spectral feature extraction by fusing features extracted from three parallel sub-convolutional and pooling layers within the same channel. Experimental results show that the fusion network performs well in COD detection. The proposed method demonstrates superior performance compared to traditional and deep learning methods such as partial least squares regression (PLSR), support vector machines (SVM), artificial neural network (ANN), and 1D-CNNs. It significantly improves the accuracy of UV-vis spectroscopy for COD detection, achieving higher precision in real-time water quality monitoring.

Recently, OT (operational technology) networks of industrial control systems have been combined with IT networks. Therefore, OT networks have inherited the vulnerabilities and attack paths existing in IT networks. Consequently, attacks on industrial control systems are increasing, and research on technologies combined with artificial intelligence for detecting attacks is active. Current research focuses on detecting attacks and improving the detection accuracy. Few studies exist on metrics that interpret anomaly detection results. Different analysis metrics are required depending on the characteristics of the industrial control system data used for anomaly detection and the type of attack they contain. We focused on the fact that industrial control system data are time series data. The accuracy and F1-score are used as metrics for interpreting anomaly detection results. However, these metrics are not suitable for evaluating anomaly detection in time series data. Because it is not possible to accurately determine the start and end of an attack, range-based performance metrics must be used. Therefore, in this study, when evaluating anomaly detection performed on time series data, we propose a range-based performance metric with an improved algorithm. The previously studied range-based performance metric time-series aware precision and recall (TaPR) evaluated all attacks equally. In this study, improved performance metrics were studied by deriving ambiguous instances according to the characteristics of each attack and redefining the algorithm of the TaPR metric. This study provides accurate assessments when performing anomaly detection on time series data and allows predictions to be evaluated based on the characteristics of the attack.

In the automated Industrial Control System (ICS) where advanced technology is being integrated with core infrastructure, technology development is ahead of the application of security solutions. Our city, power, and transportation control systems are getting smarter and more efficient, but new connectivity and interoperability are making them more vulnerable than ever before. Accordingly, various studies have been conducted for anomaly detection in ICS. In this paper, we propose an unsupervised stacked bidirectional Long Short-Term Memory (LSTM) model for automated anomaly detection in large-scale ICS and introduce a method for performance improvement. In addition, it was written based on participation in HAICon2020, an ICS security threat detection contest hosted by the National Security Research Institute. We use the HAI 2.0 dataset published at HAICon2020 and use Time-series Aware Precision and Recall (TaPR), which is suitable for anomaly detection evaluation in ICS. As a result of submission of test data, we were awarded 2nd place at HAICon2020. We have detected anomalies in ICS. As a follow-up work, we will do further research to identify the sensor and actuator that caused the anomaly and to quickly respond and recover.

Recent trends in automation technology lead to a rising exposition of industrial control systems (ICS) to new vulnerabilities. This requires the introduction of proper security approaches in this field. Prevalent in ICS is the use of access control. Especially in critical infrastructures, however, preventive security measures should be complemented by reactive ones, such as intrusion detection. Beginning from the characteristics of automation networks we outline the implications for a suitable application of intrusion detection in this field. On this basis, an approach for creation of self-learning anomaly detection for ICS protocols is presented. In contrast to other approaches, it takes all network data into account: flow information, application data, and the packet order. We discuss the challenges that have to be solved in each step of the network data analysis to identify future aspects of research towards learning normality in industrial control networks.

Novel radionuclides identification method based on Hilbert–Huang Transform and Convolutional Neural Network with gamma-ray pulse signal

The origin of tobacco is the most important factor in determining the style characteristics and intrinsic quality of tobacco. There are many applications for the identification of tobacco origin by near-infrared spectroscopy. In order to improve the accuracy of the tobacco origin classification, a near-infrared spectrum (NIRS) identification method based on multimodal convolutional neural networks (CNN) was proposed, taking advantage of the strong feature extraction ability of the CNN. Firstly, the one-dimensional convolutional neural network (1-D CNN) is used to extract and combine the pattern features of one-dimensional NIRS data, and then the extracted features are used for classification. Secondly, the one-dimensional NIRS data are converted into two-dimensional spectral images, and the structure features are extracted from two-dimensional spectral images by the two-dimensional convolutional neural network (2-D CNN) method. The classification is performed by the combination of global and local training features. Finally, the influences of different network structure parameters on model identification performance are studied, and the optimal CNN models are selected and compared. The multimodal NIR-CNN identification models of tobacco origin were established by using NIRS of 5,200 tobacco samples from 10 major tobacco producing provinces in China and 3 foreign countries. The classification accuracy of 1-D CNN and 2-D CNN models was 93.15% and 93.05%, respectively, which was better than the traditional PLS-DA method. The experimental results show that the application of 1-D CNN and 2-D CNN can accurately and reliably distinguish the NIRS data, and it can be developed into a new rapid identification method of tobacco origin, which has an important promotion value.

With the development of machine learning in recent years, the application of machine learning to machine fault diagnosis has become increasingly popular. Applying traditional feature extraction methods for complex systems will weaken the characterization capacity of features, which are not conducive to subsequent classification work. A reciprocating compressor is a complex system. In order to improve the fault diagnosis accuracy of complex systems, this paper does not use traditional fault diagnosis methods and applies deep convolutional neural networks (CNNs) to process this nonlinear and non-stationary fault signal. The valve fault data is obtained from the reciprocating compressor test bench of the Daqing Natural Gas Company. Firstly, the single-channel vibration signal is collected on the reciprocating compressor and the one-dimensional CNN (1-D CNN) is used for fault diagnosis and compared with the traditional model to verify the effectiveness of the 1-D CNN. Next, the collected eight channels signals (three channels of vibration signals, four channels of pressure signals, one channel key phase signal) are applied by 1-D CNN and 2-D CNN for fault diagnosis to verify the CNN that it is still suitable for multi-channel signal processing. Finally, further study on the influence of the input of different channel signal combinations on the model diagnosis accuracy is carried out. Experiments show that the seven-channel signal (three-channel vibration signal, four-channel pressure signal) with the key phase signal removed has the highest diagnostic accuracy in the 2-D CNN. Therefore, proper deletion of useless channels can not only speed up network operations but also improve diagnosis accuracy.

Convolutional neural networks are known to outperform all other neural network models when classifying a wide variety of 2D-shapes. This type of networks supports a massively parallel extraction of low-level features in the processed images. Especially this characteristic is assumed to impact the performance of convolutional networks in character recognition tasks - and in particular when considering scaled, rotated, translated or otherwise deformed patterns. Yet training of convolutional networks is rather time-consuming due to the relatively high complexity of the entire model. To speed-up the training process, we will propose a new variant of convolutional networks - the so-called hybrid convolutional neural network (HCNN). HCNN-networks combine the original idea of LeCun's convolutional networks with the benefits of RBF-like neurons in all the layers and with the winner-takes- all mechanism applied during recall. In the tests done so far in hand-written digit recognition, HCNN proved to be capable of considerably speeding-up the training process while maintaining roughly the same performance of the trained networks like original convolutional networks.

To develop and evaluate deep learning models for cardiac arrest rhythm classification during cardiopulmonary resuscitation (CPR), we analyzed 508 electrocardiogram (ECG) segments (each 4 s in duration, recorded at 250 Hz) from 131 cardiac arrest patients. Compression-affected segments were recorded during chest compressions, while non-compression segments were extracted during compression pauses or immediately after return of spontaneous circulation (ROSC) declaration. One-dimensional convolutional neural network (1D-CNN) and recurrent neural network (RNN) models were employed for four binary classification tasks: (1) shockable rhythms (VF and pVT) versus non-shockable rhythms (asystole and PEA) in all ECG segments; (2) the same classification in compression-affected ECG segments; (3) pulse-generating rhythms (ROSC rhythm) versus non-pulse-generating rhythms (asystole, PEA, VF and pVT) in all ECG segments; and (4) the same classification in compression-affected ECG segments. The 1D-CNN model consistently outperformed the RNN model across all classification tasks. For shockable versus non-shockable rhythm classification, the 1D-CNN achieved accuracies of 91.3% and 89.8% for all ECG segments and compression-affected ECG segments, respectively, compared to 50.6% and 54.5% for the RNN. In detecting pulse-generating rhythms, the 1D-CNN demonstrated accuracies of 90.9% and 85.7% for all ECG segments and compression-affected ECG segments, respectively, while the RNN achieved 92.2% and 84.4%. The 1D-CNN model demonstrated superior performance in cardiac arrest rhythm classification, maintaining high accuracy even with compression-affected ECG data.

In recent decades, Industrial Control Systems (ICS) have been affected by heterogeneous cyberattacks that have a huge impact on the physical world and the people's safety. Nowadays, the techniques achieving the best performance in the detection of cyber anomalies are based on Machine Learning and, more recently, Deep Learning. Due to the incipient stage of cybersecurity research in ICS, the availability of datasets enabling the evaluation of anomaly detection techniques is insufficient. In this paper, we propose a methodology to generate reliable anomaly detection datasets in ICS that consists of four steps: attacks selection, attacks deployment, traffic capture and features computation. The proposed methodology has been used to generate the Electra Dataset, whose main goal is the evaluation of cybersecurity techniques in an electric traction substation used in the railway industry. Using the Electra dataset, we train several Machine Learning and Deep Learning models to detect anomalies in ICS and the performed experiments show that the models have high precision and, therefore, demonstrate the suitability of our dataset for use in production systems.

Deep learning assisted femtosecond laser-ablation spark-induced breakdown spectroscopy employed for rapid and accurate identification of bismuth brass