A Hybrid Framework for Detecting and Mitigating Cyber-Attacks in Industrial Control Systems Through Physical Process Monitoring

Abstract

The efficiency of Industrial Control Systems (ICS) has been threatened by the increasing complexity of cyber-physical attacks owing to the convergence of Information Technology (IT) and Operational Technology (OT). The intrusion detection systems designed to address this issue focus on network monitoring. However, these systems were not entirely reliable in identifying complex attacks, such as those employing cyber-physical means to control physical processes concurrently with normal communications. To address this deficiency, the research paper proposes a comprehensive hybrid solution to detect and mitigate cyber-physical attacks simultaneously. This research combines both cyber-network and physical process monitoring. The solution employs a Random Forest classifier to detect cyber-physical attacks and an LSTM-based time series model to detect anomalies in multivariate sensor and actuator data of physical processes. The outputs of both detection models are optimized through a decision fusion approach. The detection framework also incorporates an automated response mechanism that isolates malicious units, generates alerts, and initializes safe operation modes during detected attacks. Additionally, to enhance the efficiency of the solution, an adaptive learning component has been incorporated to optimize detection and responses based on feedback derived from previous attacks and mitigation actions. The solution has been evaluated using the BATADAL dataset to demonstrate its effectiveness in terms of accuracy, reduction in false positives, and real-time cybersecurity performance for safeguarding ICS. This research applies a comprehensive hybrid approach aligned with real-world ICS, addressing identified challenges in current cyber-physical threats to provide effective protection for ICS.