Performance Analysis of the Two-Stage Hybrid Anomaly Detection Model for ICS Subjected to Cyberattacks

This study presents a performance comparison of a proposed two-staged hybrid anomaly detection model with several state-of-the-art models in the context of industrial control systems under the influence of cyberattacks. Developed hybrid method consists of two stages. In the first stage, hierarchical clustering is performed to create a dendrogram from the raw data. The resulting dendrogram is then cut on a variable level when the data is clustered without mixing normal and anomalous data. In the second stage an ensemble of several unsupervised anomaly detection methods is used to determine the label for the clusters from the first stage. Evaluation of methods is made with SWaT and HAI datasets using common machine learning models metrics of performance. Proposed method demonstrated high performance for the task of determining the anomalous states for the SWaT dataset and comparable performance for the HAI dataset even with supervised anomaly detection methods.