A Real-Time Anomaly Detection Method for Industrial Control Systems Based on Long-Short Period Deterministic Finite Automaton

Anomaly detection has proven effective in detecting cyber-attacks in industrial control systems (ICS). However, most existing anomaly detection methods suffer from low accuracy because they ignore the effects of packet loss and network delay on time features, the sequential nature of transition time, masquerade transitions, and system recovery. Meanwhile, current cyber-physical model (CPM) construction methods struggle to effectively address the state explosion problem and properly balance the removal and retention of low frequency states (LFS). In this article, we propose a novel baseline model for ICS to detect anomalies through learning device-level polling time patterns and system-level CPM. The polling time pattern learning method reduces the effects of packet loss and network delay on time features by extracting only matching packets and replacing outliers. The CPM construction method mitigates state explosion through mixed-event discretization, reduces the effects of network delay on transition/action times through outlier replacement, and captures the sequential nature of transition times with circular permutation sets (CPSets). CPM model optimization uses a post-pruning algorithm to balance the removal and retention of LFSs, and a CPM periodicity detection method that mitigates the effects of network delay to ensure that all industrial process periods are detected. A real-time anomaly detection method with a two-layer defence mechanism is proposed using the baseline model. Experimental results from two lab-scale ICSs with six process-related attacks confirm the effectiveness and superiority of the proposed method. It achieves average F1 scores of 98.81% and accuracy of 99.24%, outperforming the state-of-the-art work by 18.51% and 13.96%, respectively.