Robust Multivariate Anomaly Based Intrusion Detection System for Cyber-Physical

Systems using Low Rank Matrix

Aneet K. Dutta Bhaskar Mukhoty Sandeep K. Shukla

C3i Center,Computer Science & C3i Center,Computer Science & C3i Center,Computer Science &
Engineering Department Engineering Department Engineering Department
Indian Institute of Technology Kanpur Indian Institute of Technology Kanpur Indian Institute of Technology Kanpur
India India India
Email: aneet@cse.iitk.ac.in Email: bhaskarm@cse.iitk.ac.in Email: sandeeps@cse.iitk.ac.in

Abstract—Motivation, problem statement, approach, re-
sults,conclusions
The
1. Introduction
The entire economy of a nation fuels by the proper
functioning of the critical infrastructure. The critical infras-
tructures include health care, manufacturing, water treat-
ment, transportation, and power system. The disruption in
the service of critical infrastructures can affect people’s lives
even for a minimal amount of time. With the advancement of
technology in network communications, the SCADA, an es-
sential component of any critical infrastructures, has moved
to IP based communication from serial communication lead-
ing to an increase in the attack surface for the attackers
to penetrate these systems. With the IP convergence, their
networks are further integrated with the IT network and
exposed to adversaries outside the operational technologies
(OT) networks. There is an immediate need to detect the
attacks in these systems and generate an alert in real-time.
For this reason for detecting the attacks in real-time, the
Intrusion Detection System must be of low time complexity
during the test phase.
The OT engineers ensured the proper functioning of
this cyber-physical system during the design phase without
considering the security threats to this system. Consequently,
many security vulnerabilities exist in the cyber-physical
systems, like in the industrial communication protocol like
MODBUS. The packets are unencrypted and do not have any
authorization mechanism to validate the sender, thus making
the protocol vulnerable to man in the middle (MITM) attack
and false data injection. The vulnerabilities like remote code
execution(RCE), improper credential management, stack &
buffer overflow, and memory corruption make the SCADA
software and HMI devices easy targets for the attackers.
Now, changing all the pieces of equipment in existing
infrastructure with updated and secured protocols are time-
consuming and expensive. Instead, we developed a solution
that can retrofit with the existing system to protect the
system with the detection of attacks in real-time.
There are two kinds of approaches in designing an IDS,
model-driven approach and data-driven approach. In model-
driven based IDS consists of rules which check whether
any system dynamics are not violating. The IDS in Indus-
trial Control System(ICS) generally models the behavior
of the system because of the reason that the system fol-
lows the proper law of physics. These systems are large
and complex, consisting of many physical parameters that
are measured by devices called sensors and controlled by
actuators. Therefore, manually identifying rules to model
the behavior of these complex systems is not feasible. The
data-driven approach helps us in sketching ICS’s behavior
and understanding the system’s underlying dynamics. In
real-time, when the system’s functioning deviates from the
modeled behavior beyond a predetermined threshold, it is
considered an anomaly.
With advancements in the field of machine learning and
deep learning, many data-driven based IDS exists. Since
this machine learning and deep learning-based intrusion
detection methods are dependent on the data, there are some
challenges and concerns. These are:
• the unavailability of properly labeled data of the
cyber-physical system’s behavior.
• Most machine learning and deep learning-based IDS
are not outlier resistant and adversarial resistant.
Thus, the robustness of these detection mechanisms
is not guaranteed.
• The use of highly sophisticated machine learning
or deep learning models may not be feasible in a
resource-constrained environment.
In this paper, our work focuses on devising a robust
anomaly detection algorithm that will learn the deterministic
structure of the cyber-physical system and detect anomaly
when the system’s behavior deviates from the modeled be-
havior learned by the algorithm. The deterministic structure
of the cyber-physical system’s behavior is obtained in a
low dimensional subspace by recovering a low-rank ma-
trix by applying the Robust Principal Component Analysis
technique. The orthonormal basis vectors of these low-
dimensional subspaces are determined, which will help us
determine the closest point of the given vector comprising
of readings from sensors and actuators associated with the
system in the low dimensional subspace. A cluster forms
of the vectors projected in the low dimensional space, and
a threshold is determined. At the test phase, vectors are
projected in the low-dimensional subspace, and based on the
distance of the test vector to the cluster anomaly is flagged.
The main contribution of this paper is:
• We propose a multivariate model to detect
anomalies in the behavior of the cyber physical
systems with limited resource requirements.
• The proposed intrusion detection model is ro-
bust and outlier resistant. Also it is adversarial
resistant(Poisoning attack in which the adversary
contaminates the training data).
• Our method retrofits to the existing infrastruc-
ture of an ICS.
• The IDS can be developed with very small
amount of labeled data(only labeled as Normal
behavior).
• The IDS developed requires very limited memory
and is time efficient making it suitable to deploy
for detecting anomalies in real-time.
2. Background and Related Work
With the rapid progress towards industry 4.0 and IP-
convergence the risk of cyberattacks in the cyber-physical
systems are increasing every day. The chances of state-
sponsored attacks on the cyber-physical systems are high
and proper detection, and prevention mechanism needs
to be in place to protect this infrastructures. There has
been a significant amount of research going on in this
area. Researchers from different backgrounds have pro-
posed intrusion detection mechanisms for cyber-physical
systems.Goldenberg et al. [2] proposes a deterministic fi-
nite automata(DFA) based intrusion detection system. The
network traffic of the cyber-physical system is modeled
by constructing a DFA. The construction of minimal-sized
DFA will reach a final state when the system is under
normal behavior and will reach a non-final or dead state
when the system behaves maliciously is NP-hard. DFA’s can
be constructed for an instance of cyber-physical systems,
but DFA based IDS are highly sensitive and have a high
rate of false-positives.Cheng et al. [11] proposed a similar
idea to [1] which is an intrusion detection mechanisms
using finite-state automata (FSA). FSA is designed to model
the programs’ control flow, i.e., system calls and memory
addresses referred to or API calls executed in the cyber-
physical system. The IDS proposed by Cheng et al. has
significant overhead and time constraints because of con-
tinuous monitoring of the CPS software’s system calls. It
has a limited ability to detect attacks as it only detects
when the attacker changes the execution control flow in
the cyber-physical system. [5] propose an invariants based
technique for generating alarms when the system behavior
violates the invariants derived from the correlations between
the different variables(sensors/actuators). To generate the
correct invariants, the intrusion detection developer must
have detailed knowledge about the cyber-physical system
dynamics.
Bernabeu et al. [1] developed an intrusion detection
mechanism based on a decision tree algorithm to protect the
power grid. [1] demonstrates an interesting fact about how
the critical points in the power-grid changes during differ-
ent environmental scenarios and the necessity of different
intrusion detection models in different seasons. Hence, the
supervised learning based intrusion detection mechanisms
need to be updated with properly labeled data of normal and
attack classes at different environmental conditions. How-
ever, the availability of adequately labeled data of cyber-
physical systems at different conditions is a considerable
challenge.
Since the availability of adequately labeled data of the
cyber-physical system’s behavior is a challenge, various
anomaly-based intrusion detection systems are proposed.
The idea behind any anomaly-based intrusion detection
mechanism is that the cyber-physical system’s normal be-
havior is modeled, and the deviation from the modeled
behavior is measured during the run-time. If the measure
of the deviation crosses the pre-determined threshold, the
anomaly is flagged.In the papers [7], [8], [14] and [15]
anomaly-based intrusion detection techniques are proposed.
In this paper, RNN and LSTM are used to build a predictive
model for each variable individually by training using the
system’s normal behavior. At each time step, the model
predicts the next reading. The difference between the actual
reading and the predicted reading is measured, and if the dif-
ference is above the predetermined threshold, then anomaly
is flagged. The underlying assumption for developing these
anomaly-based IDS is that the data used for training the
models is outlier free. These may not be the case in a
practical scenario due to the malfunctioning of different
sensors resulting in corruption or missing data in the training
dataset. The presence of outliers or corrupted data in the
training set will profoundly affect the IDS’s performance
and accuracy. Aoudi et al. [10] proposed an anomaly-based
IDS in which the normal behavior of the cyber-physical
system is modeled, and during the test phase, the system’s
current behavior is measured to the modeled behavior of the
system. If the deviation between the current behavior and the
modeled behavior crosses a certain threshold, an anomaly is
flagged. For each variable, the time-series data is converted
to a Hankel matrix. A low-dimensional subspace is identified
that captures the deterministic structure of the cyber-physical
system’s dynamics with the help of SVD. Since the SVD is
applied to the covariance matrix XX T the IDS proposed is
not robust to the outliers present in the training data. Also,
this proposed IDS are univariate and separate models are
need to be trained and deployed in the system for detecting
the attacks in the overall infrastructure, it is not feasible for
deployment in resource constrained environments.
The ideas in the papers [6] and [13] are similar to these
in [7], [8], [14] and [15] but in a multivariate setting. The
multivariate IDS solves the problem of deploying separate
models for each variable and can be deployed in real-
time in a resource-constrained environment. However, the
underlying assumption of outlier free training data and the
whole training data belongs to the normal class persists.
Therefore, these IDS mechanisms can not guarantee robust-
ness essential for a practical scenario.
3. System Architecture
In our work, the communication link between the PLC
and SCADA is the threat vector due to vulnerable industrial
communication protocols like MODBUS. Since command
injection, false data injection, replay, and MITM attacks are
possible due to MODBUS’s vulnerability, it will enable the
attacker to change the dynamics of the system. The attack
scenarios generated are by manipulating the sensor and ac-
tuator values in the data packets communicated between the
PLC and SCADA (false data injection attacks). Any number
of sensors or actuators or combinations of any number of
sensors or actuators can be modified, which depicts that the
number of attack scenarios or the number of undesired state
of the cyber-physical system is infinite.
The Intrusion Detection System is deployed within the
SCADA host, which collects the infrastructure’s entire data
and maintains the overall state. IDS read the measurements
of the sensors and actuators from the historian database to
determine that the cyber-physical system’s current behavior
is normal or anomalous.
Figure 1. Architecture of the integrated SCADA software & IDS within
SCADA host
Figure 1 describes how the data flows between the dif-
ferent components within the SCADA host. The readings of
all the sensors and actuators, along with the timestamp, are
logged in to the historian server. The SCADA software reads
the data from the historian server to monitor the system’s
current readings and state. Our proposed IDS deployed in
the SCADA host reads the data from the historian server
in real-time, calculates the anomaly score, and sends the
necessary information to the notification system, and stores
it in the event log database.
The Intrusion Detection System(IDS) developed by con-
sidering the system’s behavioral characteristics will help to
defend the infrastructure against the attackers who are trying
to change the state of the system to an undesirable state by
manipulating the dynamics of the system.
4. Proposed Methodology
The behavior of the cyber-physical systems has a deter-
ministic structure following the laws of Physics. Like for
simple example, if the heater is on, the temperature will
increase, or the inflow rate of the water is determined from
the differential pressure between the two tanks. Therefore,
this deterministic structure in the behavior of the cyber-
physical system is mathematically modeled. The system’s
malicious or anomalous behavior is detected when the on-
going behavior deviates from the system’s mathematically
modeled behavior. Thus, intrusion detection in the cyber-
physical system is a general anomaly detection problem.
The deep learning and machine learning techniques are
widely used to solve the anomaly detection problem. How-
ever, specific security issues exist in these techniques, which
will enable the attacker to create carefully crafted inputs
such that these intrusion detection mechanisms will fail to
classify these examples as an anomaly correctly. Therefore,
the robustness of the intrusion detection mechanisms is
essential to protect the model against outliers, missing data,
and poisoning of the training data.
In this paper, our work focuses on devising a robust
anomaly detection algorithm that will learn the deterministic
structure of the cyber-physical system and detect anomaly
when the system’s behavior deviates from the modeled
behavior learned by the algorithm.
These are the following steps to develop the Intrusion
Detection System.
• Dataset Collection
• Anomaly Detection Algorithm
• Evaluation of the the proposed methodology in the
Test Phase.
• Time & Space Analysis
• The performance of the proposed IDS in the pres-
ence of the outliers.
• Deployment of the IDS in real-time.
4.1. Dataset Collection
4.1.1. Secure Water Treatement(SWaT) Testbed. In the
51
SWaT dataset {xi , yi }N
i=1 where xi IR , N is the number
of datapoints (record) and yi is the label depicting with
Normal/Attack. The vector xi consists of reading of ac-
tuators and sensors at each timestamp. In SWaT dataset,
N = 449919, out of which 395298 are normal data points
and 54621 are attack data points comprising of 36 attack
scenarios.
4.1.2. Tennessee-Eastman Process. In the TE process
41
dataset {xi }N
i=1 where xi IR , N is the number of data-
points (record). The vector xi consists readings of sensors
at each timestamp. In TE process dataset, N = 4801, out of
which first 4000 data points belongs to normal behavior of
the system and the last 800 are observations corresponding
to anomalous behavior of the system.
4.1.3. Govt. Sponsored Power Testbed in India. In the
31
power testbed dataset {xi }Ni=1 where xi IR , N is the
number of datapoints (record). The vector xi consists read-
ings of sensors corresponding to voltage, current, power
and phase angle reading at each timestamp. In this dataset,
N = 12310, out of which first 12125 data points belongs
to normal behavior of the system and 185 are observations
corresponding to the behavior of the system when the system
is subjected under attack.
4.2. Anomaly Detection Algorithm
The first phase of devising the anomaly detection algo-
rithm is to extract the deterministic structure of the cyber-
physical system’s behavior.
4.2.1. Determining Deterministic Structure of the Cyber-
Physical System’s behavior–Robust Principal Compo-
nent Analysis. Since the cyber-physical system’s behavior
has a deterministic structure, the data will lie in a low
dimensional subspace. PCA is a widely used technique for
dimensionality reduction, but it is highly brittle and outlier
sensitive. The low dimensional subspace of the data is
determined by using Robust PCA(RPCA), which makes the
intrusion detection mechanism resistant to outliers, missing
data, and against poisoning of the training data.
The two matrices L(low-rank matrix) and S0 (Sparse
matrix) are recovered given a large data matrix M where L
is the low rank matrix representing the deterministic stricture
of the system’s behavior in low-dimensional subspace and
S0 is the sparse matrix containing the outliers. This problem
is solved by a convex program called Principal Component
Pursuit which minimizes a weighted combination of the
nuclear norm and l1 norm. Solving this problem suggests
that we will be able to recover the principal components of
the data matrix even if some of the entries in the matrix are
corrupt or outliers.
Optimization Problem
The optimization problem to solve RPCA problem is:
minimize ||L||∗ + λ||S0 ||1
subject to L + S = M
Solving the above optimization problem exactly recovers
low-rank L and sparse S0 because:
• The nuclear norm of the L matrix is the sum of the
singular values of L.
• Since the number of non-zero singular values is the
rank of a matrix, therefore minimizing the nuclear
norm will yield us a low-rank matrix.
• Minimizing the l1 norm of the matrix S will ensure
sparsity of S0 .
The convex PCP problem using Augmented Lagrangian
Multiplier(ALM).
4.2.2. Mathematical Representation of the Deterministic
Structure of the Cyber-Physical System’s behavior.
After obtaining the deterministic structure of the cyber-
physical system’s behavior, the mathematical representation
of this behavior is determined. B is the set of basis vectors
{b1 , b2 , b3 , ........, bk } obtained from the low rank matrix L.
The basis vectors {b1 , b2 , b3 , ........, bk } will span the low
dimensional subspace S , which captures the deterministic
structure of the cyber-physical system’s behavior.
The basis vectors {b1 , b2 , b3 , ........, bk } must be or-
thonormal to each other to make the computation faster
in the testing phase which will allow us to deploy the
intrusion detection system in resource constraint devices. If
the basis vectors {b1 , b2 , b3 , ........, bk } are not orthonormal
to each other, then Gram–Schmidt method is applied to
orthonormalize this set of vectors.
Therefore, V is the set of orthonormal basis vectors
{v1 , v2 , v3 , ...., vk } derived from the low rank matrix L or
by applying Gram-Schmidt method to B . This orthonormal
basis vectors are organized as a matrix A in the form of
column vectors.
We know, xIRn which can be expressed as x = v + w
where v is the projection of x on the subspace S and w is
the orthogonal complement.
P rojv x = A(AT A)−1 AT x
Since, {v1 , v2 , v3 , ...., vk } are orthonormal to each other,
therefore (AT A) = Ik .
P rojv x = AAT x
The euclidean norm of the ||P rojv x||2 is given by:
||AAT x||2 = (AAT x).(AAT x)
||AAT x||2 = (AAT x)T (AAT x)
||AAT x||2 = xT A(AT A)AT x
Since, (AT A) = I
||AAT x||2 = xT AAT x
||AAT x||2 = (Ax)T (Ax)
||AAT x||2 = ||AT x||2
Hence, it is proved that the square euclidean norm
||AAT x|| = ||AT x||.
After obtaining A, xi is projected in this low-
dimensional subspace S and the euclidean norm of it is
calculated, where vector xi consists of reading actuators
and sensors at each timestamp. The xi ’s are projected in
the low-dimensional subspace because the P rojv xi is the
closest point of xi in the subspace S . The median of the
projected points in subspace S is calculated.
Let m be the number of data points projected in the
subspace S
 For each xi in the training dataset, Zi = AT xi , where
Z is a matrix storing all the projected datapoint xi in the
subspace S .
med=median of Z along axis-X.
The deterministic behavior of the cyber-physical system
can be mathematically represented by the matrix A and the
vector med.
4.2.3. Threshold Determination(Θ). The median of the
distribution is the center of probability. It is the point
situated at the center of the sample where the probability
is exact 21 .
The threshold(Θ) depicts the maximum deviation of the
cyber-physical system’s behavior from the median which is
allowed by the anomaly detection algorithm. The value of
the threshold(Θ) is determined by calculating the highest
anomaly score recorded when the algorithm is run for a
set of data points which are already classified as Normal
behavior.
T 2
AnomalyScore(d) = ||med − A xi ||
Θ = max{di } where i[1, n] where di is the anomaly
score corresponding to each data point in the which is
pre-classified as normal behavior. The number of data
points in the set is n.
Therefore, the deterministic or normal behavior of
the cyber-physical system can be mathematically repre-
sented by the matrix A, the vector med and the scalar
value Θ.
4.3. Classification of the Test Behavior
The IDS classifies by calculating the anomaly score(di )
and comparing it with the threshold(Θ). If the anomaly
score(di ) is higher than the threshold(Θ), then the data point
xi is flagged as an anomaly.
4.4. Time & Space Analysis
The space required for deploying the the intrusion de-
tection model is:
• Matrix A of dimension d ∗ r; where d is the number
features in matrix M and r is the rank of low rank
matrix L.
• A vector of size r.
• A scalar value Θ.
Therefore, the space complexity of our proposed IDS is
O(rd).
The steps involved in classifying a test data point are as
follows:
• A matrix multiplication between AT and xi where
AT is r ∗ d dimension and xi is d ∗ 1 dimension.
The time complexity of this matrix multiplication is
O(rd).
• Euclidean distance is calculated between two r ∗ 1
vector. The time complexity of calculating the Eu-
clidean norm between this two vectors is O(r).
• The calculated euclidean norm is compared with the
threshold(Θ) in O(1) time.
Therefore, the time complexity of our proposed IDS is
O(rd).
Since, r << d, the proposed IDS functions in O(d)
space and time complexity.
5. Experiments & Results
To evaluate the performance and accuracy of the pro-
posed intrusion-detection model, we have used the SWaT
dataset, Tennessee Eastman process dataset and a dataset
corresponding to a Government of India sponsored power
distribution testbed.
5.1. Training Phase
5.1.1. Secure Water Treatement(SWaT) Testbed. The
data matrix M of dimension (496800 ∗ 51) is given as an
input to the RPCA algorithm to recover the low rank matrix
L. The rank r of L is found to be 18. Figure ?? show
how the error which is the Frobenius norm of ||M − L − S||
due to the constraint mentioned in the optimization problem
L + S = M , reduces at each epoch.. The stopping criteria is
either 10, 000 epochs or when error is less than 10−7 ||M ||F .
For our intrusion detection model, the number of epochs
required for obtaining the low-rank matrix L by applying
RPCA is 5970.
Figure 2. Error calculated at each Epochs while running RPCA on SWaT
Dataset
The orthonormal basis vectors {v1 , v2 , v3 , ...., v18 } are
each of (51 ∗ 1) dimension. The matrix A comprising of the
orthonormal basis vectors of L is of dimension (51 ∗ 18).
The datapoints xi each of (51∗1) dimension is projected on
the subspace S by AT xi resulting in the dimension of each
projected vector to be of the dimension (18∗1). The median
vector from the set of all projected vectors is calculated. The
median is a (18 ∗ 1) column vector and the threshold(Θ) is
a scalar value.
5.1.2. Tennessee Eastman Process Dataset. The data ma-
trix M is of dimension (3000∗41) is given as an input to the
RPCA algorithm to recover the low rank matrix L. The rank
r of L is found to be 24. Figure 3 show how the error which
is the Frobenius norm of ||M − L − S|| due to the constraint
mentioned in the optimization problem L+S = M , reduces
at each epoch. For our intrusion detection model, the number
of epochs required for obtaining the low-rank matrix L by
applying RPCA is 4269.
Figure 3. Error calculated at each Epochs while running RPCA on TE
Process Dataset
The matrix A comprising of the orthonormal basis vec-
tors of L is of dimension (41 ∗ 24). The median is a (24 ∗ 1)
column vector.
5.1.3. Power Distribution Dataset. The data matrix M is
of dimension (3000 ∗ 31) is given as an input to the RPCA
algorithm to recover the low rank matrix L. The rank r of
L is found to be 9. Figure 4 show how the error which is
the Frobenius norm of ||M − L − S|| due to the constraint
mentioned in the optimization problem L+S = M , reduces
at each epoch. For our intrusion detection model, the number
of epochs required for obtaining the low-rank matrix L by
applying RPCA is 9269.
Figure 4. Error calculated at each Epochs while running RPCA on Power
Dataset
The matrix A comprising of the orthonormal basis vec-
tors of L is of dimension (31 ∗ 9). The median is a (9 ∗ 1)
column vector.
5.2. Test Phase
5.2.1. Secure Water Treatement(SWaT) Testbed. After
the training phase there are three learning parameters that are
stored i.e, A of (51∗18) dimension, median vector of (18∗1)
dimension and a scalar value Θ for the functioning of the
intrusion detection model in test phase. This shows that the
intrusion detection model designed by our algorithm does
not require much memory and can be stored in a resource
constrained environment. For demonstration, we have shown
how our IDS detects the ongoing attack considering four
different attack scenarios.
Attack Scenario 1. In attack scenario 1, the attacker’s intent
is to overflow the tank 1 by attacking on the actuator MV-
101 to remain open even if the level indicator sensor LIT-
101 is above the highest permitted level. Figure 5 shows the
reading of the sensor LIT-101 at each time step. The highest
permitted level is 800mm. We can see that the attacker is
successfully overflowing the tank from the time step 1400
to 2600. Then, when the attack stopped the level of tank
comes within the permitted level.
Figure 5. LIT-101 Sensor reading at each Time Step
Figure 6. Anomaly Score at each Time Step
Figure 6 shows the anomaly score at each time step with
the blue horizontal line as the threshold. It clearly shows
that when the attack started and eventually when the level of
water is above the permitted level the anomaly score crosses
the threshold flagging this behavior of the cyber-physical
system as an anomaly. Again, when the attack stopped and
the level of the water in the tank is within the permitted level
the anomaly score decreases and comes below the threshold
classifying the system’s behavior as normal.
Attack Scenario 2. In attack scenario 2, the attacker’s
intent is to overflow the tank 3 by attacking on the sensor
LIT-301 by increasing the level of the tank by 1mm at
each second. The attacker did not stop and the tank does
overflow(> 800mm) for a period of time. 7 shows the
reading of the sensor LIT-301 at each time step. The highest
permitted level is 800. We can see that the attacker is
successfully overflowing the tank. Then, when the attack
stopped the level of tank comes within the permitted level.
Figure 7. LIT-301 Sensor reading at each Time Step
Figure 8. Anomaly Score at each Time Step
Figure 8 shows the anomaly score at each time step with
the blue horizontal line as the threshold. It clearly shows
that when the attack started and eventually when the level
of water is above the permitted level the anomaly score
crosses the threshold explained by the peak like structure in
the plot flagging this behavior of the cyber-physical system
as an anomaly. Again, when the attack stopped and the level
of the water in the tank is within the permitted level the
anomaly score decreases and comes below the threshold
classifying the system’s behavior as normal. The sharp drop
in the anomaly score plot corresponding to the sharp drop
in the sensor reading describes that the intrusion detection
model can capture the deviation in system’s behavior.
5.2.2. Tennessee Eastman Process Dataset. After the
training phase there are three learning parameters that are
stored i.e, A of (41∗24) dimension, median vector of (24∗1)
dimension and a scalar value Θ for the functioning of the
intrusion detection model in test phase.
Attack Scenario 1. In attack scenario 1, the attacker’s intent
is to increase the value of the sensor abruptly by gradually
increasing to a point well above the desired level. Figure 9
shows the reading of the sensor XMeas(14) with time when
the sensor is under attack.
Figure 9. Xmeas(14) Sensor reading at each Time Step
Figure 10. Anomaly Score at each Time Step
Attack Scenario 2. In attack scenario 2, the attacker’s intent
is to increase the value of the sensor abruptly by gradually
increasing to a point well above the desired level. Figure 11
shows the reading of the sensor XMeas(6) with time when
the sensor is under attack.
Figure 10 and Figure 12 shows the anomaly score at each
time step with the blue horizontal line as the threshold. It
clearly shows that when the attack started and eventually
when the sensor reading is above the permitted level the
anomaly score crosses the threshold flagging this behavior
of the cyber-physical system as an anomaly.
 Figure 11. Xmeas(6) Sensor reading at each Time Step
Figure 12. Anomaly Score at each Time Step
5.2.3. Power Distribution Dataset. After the training phase
there are three learning parameters that are stored i.e, A of
(31∗9) dimension, median vector of (9∗1) dimension and a
scalar value Θ for the functioning of the intrusion detection
model in test phase.
In this attack scenario, the attacker’s intent is to increase
the value of the sensor ’PT transcontractor C3’ which is a
measures transconductance in the third phase of a 3-phase
power distribution testbed suddenly generating a spike in the
reading.Figure 13 shows the reading of the sensor XMeas(6)
with time when the sensor is under attack.
Figure 13. PT transcontractor C3 Sensor reading at each Time Step
Figure 14 shows the anomaly score at each time step
with the blue horizontal line as the threshold. It clearly
shows that when there is a sudden abnormality in the behav-
Figure 14. Anomaly Score at each Time Step
ior of the cyber-physical system, the spike in the anomaly
score plot depicts that that this abnormality in the behavior
is detected.
5.2.4. Robustness in the Presence of Outliers in the
Training Data. There are two kinds of outliers injected
into the training data:
• Gaussian Noise: Gaussian Noise with mean(µ) 0
and variance(σ) 1 is introduced to the whole train-
ing data.
• Burst Outliers: Some variables are targeted and the
data of that variables are corrupted over for a con-
secutive time stamps of length(l) at regular interval.
Tennessee Eastman Process Dataset. The variables
XMeas(6) and XMeas(14) are targeted, and the data of that
variables are corrupted at a regular interval of 25 time steps.
Figure 15 shows the reading of a variable(Xmeas(6))
which is targeted and outliers are injected at regular in-
tervals. The spikes in the reading depicts the presence of
outliers in the training data.
Figure 15. Sensor data reading in the presence of outliers
Figure 16 shows the similarity with Figure 12 and is able
which shows the robustness of the proposed IDS to detect
the anomalies in the test phase though outliers (in the form
of Gaussian noise or random ourliers) were present in the
training data.

Figure 16. Anomaly Score at each Time Step
The rank r of the recovered low rank matrix L is 24
with out the injection of outliers in the training data, and
rank r of the recovered low rank matrix L is 23 with the
injection of outliers in the training data.
5.2.5. Deployment of IDS in Real-time and the Memory
Requirement. Considering the dataset of the power dis-
tribution testbed, where A is a (31 ∗ 9) matrix and med
is a 9 dimensional vector and Θ is floating point vari-
able. The memory required to store the parameters required
for calculating the anomaly score and comparing with the
threshold value to decide whether to generate alarms or not
is (31 ∗ 9 ∗ 8) + (9 ∗ 8) + 8 = 2312 bytes i.e., 2.312KB.
The general-purpose machines in which the SCADA
software operates have a RAM of 256MB and running
simple code for matrix multiplication, and a conditional
operation is feasible. Therefore, the proposed IDS is feasible
to be deployed in real infrastructure within the SCADA host
to detect attacks in real-time.
Generally, Programmable Logic Controllers(PLC) have
Internal RAM of 256kB. The memory required to store
the IDS model is 2.312KB. If matrix multiplication and
comparison of two variables are allowed in the PLC, which
is generally possible using STL language, then our proposed
IDS can be deployed within PLC.
6. Conclusion
The conclusion goes here.
Acknowledgments
The authors would like to thank...
References
[1] Emanuel E.Bernabeu,James S.Thorp and Virgilio
teno,”Methodology for a Security/Dependability Adaptive Protection
Scheme Based on Data Mining”,IEEE TRANSACTIONS ON POWER
DELIVERY, VOL. 27, NO. 1, JANUARY 2012.
[2] Niv Goldenberg and Avishai Wool,”Accurate modeling of Mod-
bus/TCP for intrusion detection in SCADA systems”,international jour-
nal of critical infrastructure protection 6 (2013) 63–75.
[3] Yoshihiro Hashimoto,Takeshi Toyoshima, Shuichi Yogo, Masato
Koike,Takashi Hamaguchi,Sun Jing and Ichiro Koshijima,”Safety
securing approach against cyber-attacks for process control sys-
tem”,Computers and Chemical Engineering 57 (2013) 181– 186.
[4] Youbiao He, Gihan J.Mendis and Jin Wei,”Real-Time Detection of
False Data Injection Attacks in Smart Grid: A Deep Learning-Based
Intelligent Mechanism”,IEEE TRANSACTIONS ON SMART GRID,
VOL. 8, NO. 5, SEPTEMBER 2017.
[5] Sridhar Adepu and Aditya Mathur,”Distributed Attack Detection in a
Water Treatment Plant: Method and Case Study”,2018.
[6] Dan Li,Dacheng Chen,Lei Shi,Baihong Jin,Jonathan Goh and See-
Kiong Ng,”MAD-GAN: Multivariate Anomaly Detection for Time Se-
ries Data with Generative Adversarial Networks”,arXiv:1901.04997v1
[cs.LG] 15 Jan 2019.
[7] J.Goh,S.Adepu, M.Tan and Z.S.Lee, “Anomaly detection in cyber-
physical systems using recurrent neural networks”, inProc. of
HASE.IEEE, 2017, pp. 140–145.
[8] P.Malhotra,L.Vig,G.Shroff and P.Agarwal,“Long short term memory
networks for anomaly detection in time series”, inProc. ofESANN,
2015, p. 89.
[9] J.Goh,S.Adepu,K.N.Junejo,and A. Mathur, “A dataset to support re-
search in the design of secure water treatment systems,” inProc.
ofCRITIS, 2016.
[10] Wissam Aoudi,Mikel Iturbe,and Magnus Almgren,”Truth Will Out:
Departure-Based Process-Level Detection of Stealthy Attacks on Con-
trol Systems”,CCS’18, October 15-19, 2018, Toronto, ON,Canada.
[11] Long Cheng,Ke Tian,Danfeng(Daphne) Yao, Lui Sha,and Raheem A.
Beyah,”Checking is Believing: Event-Aware ProgramAnomaly Detec-
tion in Cyber-Physical Systems”,arXiv:1805.00074v2[cs.CR] 25 Mar
2019.
[12] T. Morita, S. Yogo, M. Koike, T. Hamaguchi, S. Jung, I. Koshijima,
and Y. Hashimoto,”Detection of Cyber-Attacks with Zone Dividing
and PCA”,in the proceedings of the 17th International Conference on
Knowledge based and Intelligent Information and Engineering Systems
2013.
[13] Pankaj Malhotra, Anusha Ramakrishnan, Gaurangi Anand, Lovekesh
Vig, Puneet Agarwal, Gautam Shroff,”LSTM-based Encoder-Decoder
for Multi-sensor Anomaly Detection”,ICML 2016 Anomaly Detection
Workshop, NewYork, NY, USA, 2016.
[14] Pavel Filonov, Fedor Kitashov, and Andrey Lavrentyev,”RNN-
based Early Cyber-Attack Detection for the Tennessee Eastman Pro-
cess”,arXiv:1709.02232v1 [cs.CR] 7 Sep 2017.
[15] Pavel Filonov,Andrey Lavrenty, and Artem Vorontsov,”Multivariate
Industrial Time Series with Cyber-AttackSimulation: Fault
Detection Using an LSTM-based Predictive Data Model”,
arXiv:1612.06676v2cs.LG] 26 Dec 2016.
[16] C.Alcaraz, G.Fernandez,and F.Carvajal,“Security aspects of SCADA
and DCS environments”, inCritical Infrastructure Protection, pp.
120–149, Springer, 2012.
[17] G.Y.Liao, Y.J.Chen, W.C.Lu, and T.C.Cheng,“Toward authenticating
the master in the modbus protocol”,IEEE Transactions on PowerDe-
livery, vol. 23, no. 4, pp. 2628–2629, 2008.
[18] US National Institute of Standards and Technology,”NIST cyber
security framework”, USA 2018.
[19] Emmanuel J. Candes, Xiaodong Li, Yi Ma, and John Wright,”Robust
Principal Component Analysis?”, arXiv:0912.3599v1 [cs.IT] 18 Dec
Cen- 2009.