Abstract
To ensure uninterrupted service delivery in critical sectors like electricity, water, and oil, safeguarding information systems against anomalies is imperative. Detecting anomalies within Industrial Control Systems (ICSs) is vital, but it’s challenging without a comprehensive understanding of their causes. This necessitates a well-annotated dataset encompassing diverse anomaly types, often dependent on domain experts. Unfortunately, such datasets are scarce. To address this challenge, this study introduces a specialized framework for unsupervised anomaly detection and anomaly categorization within data collected from monitoring ICSs. The framework was validated using data from a Secure Water Treatment (SWaT) testbed, where multiple cyberattacks were intentionally introduced. An Isolation Forest model was utilized, achieving 77% accuracy in anomaly identification. These anomalies were then isolated from normal samples, and a K-means clustering model categorized similar attacks and labeled anomaly clusters. The most suitable supervised model for the data was determined through experimentation with various classifiers, including SVM, Random Forest, Decision Tree, KNearest Neighbor, and AdaBoost. Remarkably, K-Nearest Neighbor (KNN) outperformed all, achieving 98% accuracy. This framework automates anomaly detection, categorization and data labeling, elevating data quality and accuracy in ICS anomaly detection while reducing the need for manual expert intervention and addressing the challenge of limited well-annotated datasets and improving the overall security of vital infrastructure sectors.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
De-chlorinator; Removes chlorine from water.
- 2.
Ultra-Filtration Tank 301.
- 3.
Reverse Osmosis Feet Tank.
References
Al-Abassi, A., Karimipour, H., Dehghantanha, A., Parizi, R.M.: An ensemble deep learning-based cyber-attack detection in industrial control system. IEEE Access 8, 83965–83973 (2020)
Liu, X., Ding, Y., Tang, H., Xiao, F.: A data mining-based framework for the identification of daily electricity usage patterns and anomaly detection in building electricity consumption data. Energy Build. 231, 110601 (2021)
Guo, P., Wang, L., Shen, J., Dong, F.: A hybrid unsupervised clustering-based anomaly detection method. Tsinghua Sci. Technol. 26(2), 146–153 (2020)
Hawkins, D.M.: Identification of outliers. Springer Netherlands, Dordrecht (1980). https://doi.org/10.1007/978-94-015-3994-4
Pathan, A.K: The state of the art in intrusion prevention and detection, vol. 44. CRC Press, Boca raton (2014)
Khaledian, E., Pandey, S., Kundu, P., Srivastava, A.K.: Real-time synchrophasor data anomaly detection and classification using isolation forest, kmeans, and loop. IEEE Trans. Smart Grid 12(3), 2378–2388 (2020)
Elnour, M., Meskin, N., Khan, K., Jain, R.: A dual-isolation-forests-based attack detection framework for industrial control systems. IEEE Access 8, 36639–36651 (2020)
Ripan, R.C., Sarker, I.H., Musfique, M.: An isolation forest learning based outlier detection approach for effectively classifying cyber anomalies. In: Abraham, A., Hanne, T., Castillo, O., Gandhi, N., Tatiane Nogueira Rios, T. (ed.) HIS 2020. AISC, vol. 1375, pp. 270–279. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-73050-5_27
Guo, P., Wang, L., Shen, J., Dong, F.: A hybrid unsupervised clustering-based anomaly detection method. Tsinghua Sci. Technol. 26(2), 146–153 (2021)
Baek, S., Kwon, D., Suh, S.C., Kim, H., Kim, I., Kim, J.: Clustering-based label estimation for network anomaly detection. Digit. Commun. Netw. 7, 37–44 (2020)
Zhang, Y.-L., Li, L., Zhou, J., Li, X., Zhou, Z.-H.: Anomaly detection with partially observed anomalies. In: Companion Proceedings of the The Web Conference 2018, pp. 639–646 (2018)
Baek, S., Kwon, D., Kim, J., Suh, S.C., Kim, H., Kim, I.: Unsupervised labeling for supervised anomaly detection in enterprise and cloud networks. In: 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud), pp. 205–210. IEEE (2017)
Mathur, A.P., Tippenhauer, N.O.: Swat: a water treatment testbed for research and training on ics security. In: 2016 International Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater), pp. 31–36. IEEE (2016)
Ahsan, M.M., Parvez Mahmud, M.A., Saha, P.K., Gupta, K.D., Siddique, Z.: Effect of data scaling methods on machine learning algorithms and model performance. Technologies 9(3), 52 (2021)
Ganapathi Raju, V.N., Prasanna Lakshmi, K., Jain, V.M., Kalidindi, A., Padma, V.: Study the influence of normalization/transformation process on the accuracy of supervised classification. In: 2020 Third International Conference on Smart Systems and Inventive Technology (ICSSIT), pp. 729–735. IEEE (2020)
Liu, F.T., Ting, K.M., Zhou, Z.H.: Isolation forest. In: 2008 Eighth IEEE International Conference on Data Mining, pp. 413–422. IEEE (2008)
Grira, N., Crucianu, M., Boujemaa, N.: Unsupervised and semi-supervised clustering: a brief survey. Rev. Mach. Learn. Techn. Proc. Multimedia Content 1, 9–16 (2004)
Rajabi, A., Eskandari, M., Ghadi, M.J., Li, L., Zhang, J., Siano, P.: A comparative study of clustering techniques for electrical load pattern segmentation. Renew. Sustain. Energy Rev. 120, 109628 (2020)
Feurer, M., Hutter, F.: Hyperparameter optimization. In: Hutter, F., Kotthoff, L. (ed.) Automated machine learning. TSSCML, pp. 3–33. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-05318-5_1
Sebayang, F.A., Lydia, M.S., Nasution, B.B.: Optimization on purity k-means using variant distance measure. In: 2020 3rd International Conference on Mechanical, Electronics, Computer, and Industrial Technology (MECnIT), pp. 143–147 (2020)
Lucas, B.: Proximity forest: an effective and scalable distance-based classifier for time series. Data Mining Knowl. Dis. 33(3), 607–635 (2019)
Zuber, M., Sirdey, R.: Efficient homomorphic evaluation of k-nn classifiers. Proc. Priv. Enhancing Technol. 2021(2), 111–129 (2021)
Rai, K., Syamala Devi, M., Guleria, A.: Decision tree based algorithm for intrusion detection. Inter. J. Adv. Netw. Appli. 7(4), 2828 (2016)
Javed, A.R., Jalil, Z., Moqurrab, S.A., Abbas, S., Liu, X.: Ensemble adaboost classifier for accurate and fast detection of botnet attacks in connected vehicles. Trans. Emerging Telecommun. Technol., e4088 (2020)
Maglaras, L.A., Jiang, J.: Intrusion detection in scada systems using machine learning techniques. In: 2014 Science and Information Conference, pp. 626–631. IEEE (2014)
Zhang, J., Xia, K., He, Z., Yin, Z., Wang, S.: Semi-supervised ensemble classifier with improved sparrow search algorithm and its application in pulmonary nodule detection. Mathematical Prob. Eng. 2021 (2021)
Syakur, M.A., Khotimah, B.K., Rochman, E.M.S., Satoto, B.D.: Integration k-means clustering method and elbow method for identification of the best customer profile cluster. IOP Conf. Ser. Mater. Sci. Eng. 336, 012017 (2018)
Shahapure, K.R., Nicholas, C.: Cluster quality analysis using silhouette score. In: 2020 IEEE 7th International Conference on Data Science and Advanced Analytics (DSAA), pp. 747–748. IEEE (2020)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Mahmud, J.S., Birihanu, E., Lendak, I. (2024). A Semi-supervised Framework for Anomaly Detection and Data Labeling for Industrial Control Systems. In: Trajanovic, M., Filipovic, N., Zdravkovic, M. (eds) Disruptive Information Technologies for a Smart Society. ICIST 2023. Lecture Notes in Networks and Systems, vol 872. Springer, Cham. https://doi.org/10.1007/978-3-031-50755-7_15
Download citation
DOI: https://doi.org/10.1007/978-3-031-50755-7_15
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-50754-0
Online ISBN: 978-3-031-50755-7
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)