Intelligent Anomaly Detection System for Industrial Control Systems

Industrial Control Systems (ICS) are essential to the operation of critical infrastructures, such as energy and manufacturing, by enabling the automated monitoring of complex industrial processes. However, with the increasing integration of ICS into diverse networks and exposure to the internet, these systems have become prime targets for cyberattacks. Despite the growing risk of cyberattacks on ICS, many existing anomaly detection methods predominantly rely on prior knowledge of attack patterns, often struggling when faced with novel or unseen threats. This paper presents a self-supervised learning mechanism that harnesses the power of a transformer encoder with a self-attention mechanism to model dependencies within sensor measurements and capture the latent representation of normal system behavior in ICS. This latent representation is then fed into a Gaussian Mixture Model (GMM) to identify deviations from the normal state. The GMM evaluates the distribution of the latent space, generating scores that indicate the distance from the expected normal distribution, thereby facilitating the identification of anomalies. Our method is rigorously evaluated using a hardware-in-the-loop testbed dataset, specifically the HAICon2020 dataset, demonstrating its potential to significantly enhance anomaly detection capabilities within industrial environments.