Anomaly Detection in Shipboard Operational Technology Systems Using Cyber Analytics

Modern naval vessels contain complicated operational technology (OT), including control and power systems. The OT of a Navy ship is vulnerable to exploitation and intrusion, resulting in anomalies that can lead to cascading failures. This paper presents a novel method to effectively detect and classify physical intrusions into shipboard operational components, which can manifest in power data. A physics-based model is used to simulate a shipboard power system to create realistic test data while adhering to the Military Interface Standard 1399 (MIL-STD-1399). A long short term memory (LSTM) machine learning algorithm, modeled in Python, is used to detect anomalies in a shipboard OT. We inject synthetic anomalies and use the LSTM model to identify anomalous behavior that may be due to a malicious cyber event. The model generates predictive data, and by comparing the predictive data to current trends, it detects data outliers. We show that our algorithmic framework effectively predicts normal system behavior while identifying deviations indicative of anomalies. The results presented in this paper demonstrate the achievement of high accuracy in anomaly detection using an LSTM. We also provide insights into how this LSTM model can be used for predictive maintenance of shipboard systems in order to allow for targeted maintenance of components when necessary and not only during fixed schedules. This research is critical for improving the operational readiness of the Naval fleet due to both the application of predicting component failures, and protecting ships from cyber threats.