Neural Network based Temporal Point Processes for Attack Detection in Industrial Control Systems

Industrial Control Systems safety is nowadays constantly jeopardized by a plethora of different attacks. The identification of malicious activities happened in the past and the prediction of future menaces is crucial more than ever. In this paper we propose a new methodology based on Marked Temporal Point Processes (MTTP) and Neural Networks in order to identify and predict threats. Our technique differs from classical Temporal Point Processes because it does not rely on prior assumptions on the form of the conditional intensity function. The latter, in fact, is learned leveraging two different Deep Learning approaches. The experimental evaluation, performed on a dataset obtained from gas pipelines, highlights that our methodology is suitable to represent logs and identify past and future threats in a completely unsupervised fashion. The results obtained confirm the validity of our approach.