Open Access

ARTICLE

Deep Learning Anomaly Detection Based on Hierarchical Status-Connection Features in Networked Control Systems

by Jianming Zhao^1,2,3,4, Peng Zeng^1,2,3,4,*, Chunyu Chen^1,2,3,4, Zhiwei Dong⁵, Jongho Han⁶

1 State Key Laboratory of Robotics, Shenyang Institute of Automation, Chinese Academy of Sciences, Shenyang, 110016, China
2 Key Laboratory of Networked Control Systems, Chinese Academy of Sciences, Shenyang 110016, China
3 Institutes for Robotics and Intelligent Manufacturing, Chinese Academy of Sciences, Shenyang, 110016, China
4 University of Chinese Academy of Sciences, Beijing, 100049, China
5 State Grid Liaoning Electric Power Company Limited Electric Power Research Institute, Shenyang, 110016, China
6 Korea Intelligent Automotive Parts Promotion Institute, Daegu, 43011, Korea

* Corresponding Author: Peng Zeng. Email:

Intelligent Automation & Soft Computing 2021, 30(1), 337-350. https://doi.org/10.32604/iasc.2021.016966

Received 16 January 2021; Accepted 11 March 2021; Issue published 26 July 2021

Abstract

As networked control systems continue to be widely used in large-scale industrial productions, industrial cyber-attacks have become an inevitable problem that can cause serious damage to critical infrastructures. In practice, industrial intrusion detection has been widely acknowledged to detect abnormal communication behaviors. However, unlike traditional IT systems, networked control systems have their own communication characteristics due to specific industrial communication protocols. Thus, simple cyber-attack modeling is inadequate and impractical for high-efficiency intrusion detection because the characteristics of network control systems are less considered. Based on the status information and transmission connection in industrial communication data payloads, which can properly express the characteristics of industrial control logic, this paper associates industrial communication features with transmission connection payload and status payload. Furthermore, transmission connection features include device address, context, time, and packet length, while status features cover measurement, input, distributed state, control state, and more. After designing a convolutional neural network (CNN) and a long short-term memory network (LSTM) to extract status features and transmission connection features from industrial communication data, this paper proposes a hierarchical deep learning anomaly detection approach, which can integrate the advantages of CNN and LSTM to achieve high-efficiency detection. The experimental results clearly show that the proposed approach, having the advantages of strong detection capability and low false alarm rate, is a superior means of anomaly detection when compared to its peers.

---

Keywords

---