Downloaded 43 times
![References
www.kaspersky.com
mlad@kaspersky.com
[1] MLAD Presentation
https://youtu.be/xXWjfYcPi_Q
[2] RNN-Βbased Early Cyber-ΒAttack Detection for the Tennessee Eastman Process. ICML 2017
Time Series Workshop, Sydney, Australia, 2017.
https://arxiv.org/abs/1709.02232
[3] Multivariate Industrial Time Series with Cyber-ΒAttack Simulation: Fault Detection Using an
LSTM-Βbased Predictive Data Model. NIPS 2016 Time Series Workshop, Barcelona, Spain, 2016.
http://arxiv.org/abs/1612.06676
[4] ICS Anomaly Detection Panel
https://www.youtube.com/watch?v=jeepkpqdurc&t=306s](https://image.slidesharecdn.com/kls4x18mladtalklavrentiev-180124081610/75/Detecting-ICS-Attacks-Using-Recurrent-Neural-Networks-16-2048.jpg)
Uploaded byKaspersky
Detecting ICS Attacks Using Recurrent Neural Networks
The document discusses a methodology to detect industrial control system (ICS) attacks using recurrent neural networks (RNN), focusing on correlations between signals in operational technology (OT). It emphasizes the significance of early anomaly detection to prevent physical damage and financial losses from such attacks, particularly by utilizing machine learning for processing multivariate time series data. The approach integrates seamlessly with existing ICS cybersecurity measures, targeting specific anomalies in OT telemetry without relying on attack nature.
Technologyβ¦
More Related Content
Similar to Detecting ICS Attacks Using Recurrent Neural Networks
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
Detecting ICS Attacks Using Recurrent Neural Networks
- 1. Andrey Β Lavrentyev Head Β ofΒ Technology Β Research Β Department, Future Β Technologies, Kaspersky Β Lab Detecting Β ICS Β Attacks Β Using Β Β Recurrent Β Neural Β Networks Β (RNN)
- 2. Plant PLC SCADA INDUSTRIAL Β DATA: β’ Multi-ΒchannelΒ ~ Β 104 Β signals Β β’ Real-Βtime Β flow Β Β ~ Β 100 Β ms β’ Big Β history Β ~ Β years β’ Noise, Β jitter, Β gaps, Β faults Β β’ Cross-Βchannel Β correlation ICS Β PLC Β β Programmable Β Logic Β Controller SCADA Β -Β Supervisory Β Control Β and Β Data Β Acquisition Β system
- 3. Control Β Loop Set Β points Actuators Disturbance ControlledΒ variables Β Cyber-ΒPhysical System Sensors Β Controller
- 4. Plant PLC SCADA Physical attacks Cyber attacks 0101010101010101 1010101010101010 ICSΒ under Β Attack Attacks may target: -Β information technology (IT) or -Β operational technology (OT)
- 5. Attacks Β on Β OTΒ are Β the Β most Β dangerous -Β quick damage to physical equipment -Β severe financial losses
- 6. How Β to Β detectΒ attacks Β on Β OT? A clue: In any real-Βworld plant, all industrial signals (sensor and actuator values, control logic parameters) are correlated and governed by physical laws An attack that modifies one signal causes corresponding changes to other signals. These correlations between signals can be established using ML
- 7. MLAD Β -Β MachineΒ Learning Β for Β Anomaly Β Detection Plant PLC SCADA Physical attacks Cyber attacks Traffic Mirroring OT Security Monitor DPI MLAD
- 8. Data-ΒDriven Β Anomaly Β DetectionΒ 1. Β Training Β under Β normal Β operating Β conditions Recurrent Β Neural Β Network Data: Β Multivariate Β Time Β Series 2. Β Online Β anomaly Β detection Β via Β prediction Β error ΓΌοΌ Anomaly Β interpretation Β based Β on Β matching Β errors Β to Β specific Β signals ΓΌοΌ Early Β detection
- 9. Understanding Β Anomalies VALUE Change PERIODChange PHASE Change
- 10. LSTM Β Recurrent Β NeuralΒ Network β’ 2 Β layers Β (2 Β x Β 64) β’ Input Β window Β size = Β prediction Β horizon (w) β’ Regularization Β β Dropout β’ Optimization Β algorithm β RMSProp β’ Loss Β function β MSE Activation: Β ReLU Activation: Β Linear
- 11.
- 12. Tennessee Β Eastman Β ProcessΒ (TEP) Reactor Separator Condenser Stripper Purge Product G/H Inlet gases A, D, E and C
- 13.
- 14.
- 15. MLAD Β Key Β Features: ΓΌοΌEarly anomaly detection in OT telemetry ΓΌοΌ Anomaly interpretation ΓΌοΌ No dependence on the nature of an attack ΓΌοΌ Seamless integration with conventional ICS cybersecurity ΓΌοΌ Additional important layer of ICS cybersecurity focused on OT protection
- 16. References www.kaspersky.com mlad@kaspersky.com [1] MLAD Presentation https://youtu.be/xXWjfYcPi_Q [2]RNN-Βbased Early Cyber-ΒAttack Detection for the Tennessee Eastman Process. ICML 2017 Time Series Workshop, Sydney, Australia, 2017. https://arxiv.org/abs/1709.02232 [3] Multivariate Industrial Time Series with Cyber-ΒAttack Simulation: Fault Detection Using an LSTM-Βbased Predictive Data Model. NIPS 2016 Time Series Workshop, Barcelona, Spain, 2016. http://arxiv.org/abs/1612.06676 [4] ICS Anomaly Detection Panel https://www.youtube.com/watch?v=jeepkpqdurc&t=306s
- 17.