Anomaly Detection System for Secure Water Treatment

Abstract

Industrial Control Systems are the backbone of critical infrastructure and it is made clear in the example of water treatment plants, where operational safety is of the utmost importance. Nonetheless, these systems are now faced with increasing threat of higher risks due to sophisti cated cyber physical attacks and equipment failures that is difficult to recognise by conventional monitoring mechanisms. Legacy systems typically have hard coded and prescriptive checks, or rely on manual review; and hence, not to timely detect complex anomalies or minor process variations;thus precluding the possibility of early intervention that could be employed to pre vent harm. In order to address these challenges, in this work, a data driven anomaly detection framework has been proposed using the well-established benchmark dataset for Secure Water Treatment (SWaT). The proposed solution is to train multiple models both from univariate and multivari ate points of view on data from high frequency sensors and to investigate interactions between disparate measurements. In this methodology, the system is able to differentiate the harmless operational noise from the real security threats using complex statistical methods. The performance of the system was carefully evaluated using standard performance measures for a variety of uni variate and multivariate models. The Z-Score Dynamic Thresholding model was the best solution in production environment, with superior Accuracy of 95.31% and a near perfect Precision of 99.46%, significantly reducing false alarms. The Rolling Quantile model also showed good performance with 95.12% Accuracy and 97.51% Precision. Other models that were evaluated included the Improved Granger HoltWinters ESD model, which achieved accuracy and 93.29% and 77.85% Precision. On the other hand, trend-based models such as CUSUM (41.85% Accuracy, 15.35% Precision) and EWMA (31.32% Accuracy, 10.73% Precision) proved less effective for this particular high volatility data set. These results confirm that data driven statistical profiling, in particular Z-Score and Rolling Quantile methods can proactively identify irregularities and reduce the risks of operation in complex ICS environments.