基于可解释的相关性对工业控制系统的异常检测
Ermiyas Birihanu1, Imre Lendák1
1Data Science and Engineering Department, Faculty of Informatics, Eotvos Lorand University, Budapest, Hungary.
Frontiers in artificial intelligence
|February 19, 2025
概括
本研究介绍了一种可解释的工业控制系统 (ICS) 异常检测方法. 它通过使用相关性和SHAP识别异常的根本原因来提高安全性,提高精度和F1分数.
科学领域:
- 网络安全 网络安全
- 工业控制系统 (ICS) 是指工业控制系统.
- 机器学习 机器学习
背景情况:
- 工业控制系统 (ICS) 对基础设施安全至关重要.
- 在ICS中现有的异常检测方法往往忽略了复杂的时间相关性,缺乏可解释性.
- 资源有限和根源原因识别的困难阻碍了当前的ICS安全方法.
研究的目的:
- 为工业控制系统 (ICS) 提出一种可解释的,基于相关性的异常检测方法.
- 解决当前关于参数选择,可解释性和根本原因分析的方法的局限性.
- 通过改进异常检测来提高ICS的安全性和安全性.
主要方法:
- 使用长短期内存网络-自编码器 (LSTM-AE) 确定最佳数据窗口大小.
- 通过皮尔森相关性提取的相关性参数集,形成一个隐性相关性矩阵 (LCM) 和隐性相关性向量 (LCV).
- 利用多变量高斯分布 (MGD) 具有异常识别的值机制,结合沙普利增量解释 (SHAP) 进行特征提取和解释性.
主要成果:
- 拟议的方法实现了高性能指标,包括0.96%的精度和0.84%的F1分数在基准数据集 (SWaT,HIL-HAI,IoT Modbus) 上.
- SHAP框架提供了对异常的洞察力,并促进了根源原因的识别.
- 在实验评估中,与现有方法相比,证明了更高的有效性.
结论:
- 开发的方法为ICS中异常检测提供了有效和可解释的解决方案.
- 它有助于ICS工程师和决策者理解和减轻安全威胁.
- 该方法通过准确识别异常和根源原因分析来提高ICS安全性.
相关概念视频
Distribution Reliability and Automation
103
Distribution reliability in electrical power systems is critical for ensuring an uninterrupted power supply to consumers at minimal cost. According to IEEE Standard Terms, reliability is the probability that a device will function without failure over a specified time period or amount of usage. For electric power distribution, this translates to maintaining continuous power supply and addressing customer concerns over power outages. Several indices, as defined by IEEE Standard 1366-2012, are...
103
Control Systems
1.0K
Control systems are everywhere in contemporary society, influencing diverse applications from aerospace to automated manufacturing. These systems can be found naturally within biological processes, such as blood sugar regulation and heart rate adjustment in response to stress, as well as in man-made systems like elevators and automated vehicles. A control system is essentially a network of subsystems and processes that collaboratively convert specific inputs into desired outputs.
At the heart...
At the heart...
1.0K
Differential Relays
100
Differential relays are used to protect generators, buses, and transformers by comparing electrical quantities at different points. When a fault occurs, the difference in current between the two points triggers the relay to operate, opening the circuit breaker. Under normal conditions, the current entering (i1) and leaving (i2) a generator are equal. When a fault occurs, however, these currents become unequal, and the difference current flows in the relay operating coil, causing the relay to...
100
Radial System Protection
88
Radial systems employ time-delay overcurrent relays to reduce load interruptions. When a fault occurs, the nearest breaker opens first, while upstream breakers remain closed due to longer delay settings. This approach ensures minimal disruption to the rest of the system.
In a radial system with a fault downstream of the third breaker, ideally, only the third breaker will open, isolating the fault and interrupting the load connected beyond it. The second breaker has a longer delay setting,...
In a radial system with a fault downstream of the third breaker, ideally, only the third breaker will open, isolating the fault and interrupting the load connected beyond it. The second breaker has a longer delay setting,...
88
Steps in Outbreak Investigation
102
In the ever-evolving field of public health, statistical analysis serves as a cornerstone for understanding and managing disease outbreaks. By leveraging various statistical tools, health professionals can predict potential outbreaks, analyze ongoing situations, and devise effective responses to mitigate impact. For that to happen, there are a few possible stages of the analysis:
102
Interpreting Run Charts
53
Run charts, essentially line graphs plotted over time, serve as fundamental yet effective tools for process analysis. They chronicle data sequentially, facilitating the identification of trends, shifts, or cyclical movements. This graphical representation is instrumental in determining whether a process is stable or exhibits signs of potential instability indicative of special cause variation. In the healthcare domain, run charts depict infection rates over time, enabling hospitals to monitor...
53


