Cyber-Attack Detection and Localization for SCADA system of CPSs

Given their mission-critical nature, SCADA systems in Cyber-Physical Systems (CPS) are highly susceptible to cyber-attacks. While abnormal system states can be detected through analyzing streaming data, accurately identifying the precise location of these attacks remains challenging due to the compensatory mechanisms inherent in CPS. In industrial control, the development of high-performance controllers that require minimal data and incur low technical debt is especially appealing. Recently, foundation models have demonstrated their effectiveness in solving various problems with few or no demonstrations, leveraging the rich prior knowledge obtained through pre-training on Internet-scale datasets. Most of these models are based on the Transformer architecture, originally designed for natural language processing (NLP) tasks. However, Transformer-based models struggle to fully capture the spatial correlations embedded in industrial software systems. Previous approaches using Graph Convolution Networks (GCNs) have largely focused on learning static graph structures of CPSs, overlooking the potential variations in dynamic, short-term spatial correlations during the mechanical processes. This paper presents a novel approach to capturing hidden spatial-temporal correlations in large-scale industrial data, offering a fresh perspective on building industrial pre-trained foundation models. Specifically, we introduce a cyber-attack detection and localization framework that incorporates Multi-scale Graph Structure Learning (MGSL) within a multi-stream sequence reconstruction architecture. The approach combines Long Short-Term Memory (LSTM) for temporal information extraction with GCNs to capture spatial correlations across multiple scales, including long-term static and short-term dynamic relationships. Additionally, a self-learning mechanism is employed to facilitate the discovery of long-term static graph structures, while feature similarities are used to identify short-term dynamic structures. The proposed MGSL framework is validated using three publicly available real-world datasets: Secure Water Treatment (SWaT A4&A5) and the BATtle of Attack Detection Algorithm (BATADAL). Experimental results demonstrate the effectiveness of MGSL, outperforming state-of-the-art methods by successfully detecting cyber-attacks, pinpointing impacted areas, and analyzing the target points of detected attacks.