Detecção de ataques em duas fases usando aprendizado de máquinas em sistemas de controle industrial de infraestruturas crítica

Abstract

The advent of Industry 4.0 has been led an increasingly integration of Industrial Control Systems (ICS) into corporate networks and to the internet. If there is the advantage of real time access to processes information and remote execution of industrial process routines, on the other hand there is an increase on the cyberattack surface, backed by different motivations. Such environments are not exclusive to corporate industries, but are an essential part of critical infrastructure from various sectors, like energy, water and nuclear plants. Attacks in those environments have impacts that are difficult or even impossible to measure, and have often been covered by journalistic articles, as in the case of the war between Russia and Ukraine. Security strategies are already used in the Information Technology (IT) networks, but they are not effective in detecting attacks in the Operation Technology (OT) environment. This work proposes a composition of supervised and unsupervised learning based on traditional Machine Learning classifiers for detecting threats, mainly as a result of False Data Injection attacks, in data from an industrial network dataset. The proposal is applied to a dataset from a Hardware-in-the-Loop simulation integrated with real components, representative of a Smart Grid that suffers injection attacks and manipulation of data transmitted by the ICS components. Several scenarios were derived from the initial dataset and the detections were evaluated by the metrics accuracy, recall, AUC and F1-score. The composition results are compared with signature detection, obtaining average relative gains between 32.3% and 179.15% depending on the metric used. The composition allowed absolute values of metrics greater than 0.952 and false negative rates reductions up to 19.36% on average depending on the metric. The analysis of false positives and false negatives made way for different choices of metric evaluations to apply on the composition, in accordance with the polices of the organization responsible for the critical infrastructure.