Distributed-Graph-Based Statistical Approach for Intrusion Detection in Cyber-Physical Systems

Cyber-physical systems have recently emerged in several practical engineering applications where security and privacy are of paramount importance. This motivated the paper and a recent surge of interest in development of innovative and novel anomaly and intrusion detection technologies. This paper proposes a novel distributed blind intrusion detection framework by modeling sensor measurements as the target graph-signal and utilizing the statistical properties of the graph-signal for intrusion detection. To fully take into account the underlying network structure, the graph similarity matrix is constructed using both the data measured by the sensors and sensors' proximity resulting in a data-adaptive and structure-aware monitoring solution. In the proposed supervised detection framework, the magnitude of the captured data is modeled by Gaussian Markov random field and the corresponding precision matrix is estimated by learning a graph Laplacian matrix from sensor measurements adaptively. The proposed intrusion detection methodology is designed based on a modified Bayesian likelihood ratio test and the closed-form expressions are derived for the test statistic. Finally, temporal analysis of the network behavior is established by computing the Bhattacharyya distance between the measurement distributions at the consecutive time instants. Experiments are conducted to evaluate the performance of the proposed method and to compare it with that of the state-of-the-art methods. The results show that the proposed intrusion detection framework provides a detection performance superior to those provided by the other existing schemes.