An Explainable Markov Chain-Machine Learning Sequential-Aware Anomaly Detection Framework for Industrial IoT Systems...

Area of Science:

• Cybersecurity
• Industrial Control Systems (ICS)
• Network Anomaly Detection

Background:

• Stealth attacks on ICS are hard to detect due to subtle, sequential malicious actions.
• OPC Unified Architecture (OPC UA) adoption in SCADA/ICS increases vulnerability to sophisticated cyberattacks.
• Traditional detection methods fail to capture the temporal dependencies crucial for identifying gradual intrusions.

Purpose of the Study:

• To develop a hybrid sequential anomaly detection pipeline for OPC UA environments.
• To address the limitations of traditional methods in detecting stealthy cyberattacks.
• To enhance the detection of sophisticated threats in critical infrastructures.

Main Methods:

• A hybrid pipeline combining Markov chain modeling for temporal dependencies and machine learning for anomaly detection.
• Integration of SHapley Additive exPlanations (SHAP) for explainability.
• Application of the PC algorithm for causal inference to understand attack root causes.

Main Results:

• A second-order sequential memory significantly improved detection performance.
• F1-score increased by +2.27%, precision by +2.33%, and recall by +3.02% in simulated Man-In-The-Middle (MITM) and denial-of-service (DoS) attacks.
• SHAP analysis identified key influential features and transitions, while causal graphs highlighted deviations from normal system structure.

Conclusions:

• The proposed hybrid sequential anomaly detection pipeline effectively detects stealthy cyberattacks in OPC UA systems.
• Incorporating sequential memory and explainability methods enhances detection accuracy and provides interpretable insights into attack mechanisms.
• This approach offers a more robust solution for securing critical infrastructures against evolving cyber threats.