Generating ICS Anomaly Data Reflecting Cyber-Attack Based on Systematic Sampling and Linear Regression.

Area of Science:

• Cybersecurity
• Industrial Control Systems (ICS)
• Data Generation

Background:

• Increasing cyber threats to industrial control systems (ICS) due to information and communications technology (ICT) integration.
• Need for realistic anomaly data to test security equipment and train personnel effectively.
• Existing challenges in acquiring sufficient anomaly data in ICS environments.

Purpose of the Study:

• To propose a novel method for generating anomaly data that accurately reflects cyber-attack characteristics within an ICS.
• To overcome the limitations of cost, time, and data availability in current anomaly data acquisition methods.

Main Methods:

• Utilizing systematic sampling and linear regression models on benign ICS data.
• Employing statistical analysis to identify and alter features indicative of cyber-attack patterns.
• Generating over 50,000 new anomaly data points using Modbus-based ICS_PCAPS data.

Main Results:

• Generated anomaly data demonstrated a shift in pattern from benign to attack data, confirmed by kernel density estimation.
• Training existing models with the newly generated data showed no significant performance degradation.
• The method successfully created anomaly data that partially mirrors attack data characteristics.

Conclusions:

• The proposed method offers a rapid, logical, and resource-efficient approach to generating cyber-attack-like anomaly data for ICS.
• This facilitates improved testing of security measures and enhances cyber training exercises.
• Addresses the critical need for accessible and representative anomaly datasets in ICS cybersecurity research.