Abstract Cyber attacks on Industrial Control Systems (ICSs) to disrupt the associated physical systems, like power grids and water treatment plants, are a harsh reality of the world today. Detection and prevention of anomalous behaviors such as cyber attacks are of vital importance. This paper focuses on a method to detect such anomalous behaviors in near real-time using laptop class processing power. ICSs depend on the sensor measurements to monitor and operate a plant. Moreover, any change in the behaviors of a physical process due to an attack can also be unearthed from the sensor measurements. Under different circumstances, these sensor measurements follow typical patterns. A partially defined Boolean function based supervised classification method, known as Logical Analysis of Data (LAD), can extract patterns (or rules) from historical sensor measurements, and these rules can categorize the condition of a plant. In this paper, these rules are used to design an Anomaly Detection System (ADS) to unearth anomalous behaviors. The efficacy of the proposed method is assessed using the sensor measurements from a testbed known as Secure Water Treatment (SWaT) system. The proposed technique is generic and can be extended to other ICSs such as power and transportation. Additionally, compared to other anomaly detection approaches, LAD-based ADS also helps to localize the anomaly.

中文翻译：

---

使用数据逻辑分析的工业控制系统异常检测

摘要 对工业控制系统 (ICS) 进行网络攻击以破坏相关的物理系统，如电网和水处理厂，是当今世界的严峻现实。检测和预防网络攻击等异常行为至关重要。本文重点介绍一种使用笔记本电脑级处理能力近乎实时地检测此类异常行为的方法。ICS 依靠传感器测量来监控和操作工厂。此外，也可以从传感器测量中发现物理过程行为因攻击而发生的任何变化。在不同情况下，这些传感器测量遵循典型模式。一种基于部分定义布尔函数的监督分类方法，称为数据逻辑分析 (LAD)，可以从历史传感器测量中提取模式（或规则），这些规则可以对植物的状况进行分类。在本文中，这些规则用于设计异常检测系统 (ADS) 以发现异常行为。使用来自称为安全水处理 (SWaT) 系统的测试台的传感器测量来评估所提出方法的功效。所提出的技术是通用的，可以扩展到其他 ICS，例如电力和交通。此外，与其他异常检测方法相比，基于 LAD 的 ADS 还有助于定位异常。使用来自称为安全水处理 (SWaT) 系统的测试台的传感器测量来评估所提出方法的功效。所提出的技术是通用的，可以扩展到其他 ICS，例如电力和交通。此外，与其他异常检测方法相比，基于 LAD 的 ADS 还有助于定位异常。使用来自称为安全水处理 (SWaT) 系统的测试台的传感器测量来评估所提出方法的功效。所提出的技术是通用的，可以扩展到其他 ICS，例如电力和交通。此外，与其他异常检测方法相比，基于 LAD 的 ADS 还有助于定位异常。