Detection and localization of cyber attacks on water treatment systems:an entropy-based approach  

作　　者：Ke LIU Mufeng WANG Rongkuan MA Zhenyong ZHANG Qiang WEI 

机构地区：[1]State Key Laboratory of Mathematical Engineering and Advanced Computing,Zhengzhou,450001,China [2]College of Control Science and Engineering,Zhejiang University,Hangzhou,310027,China

出　　处：《Frontiers of Information Technology & Electronic Engineering》2022年第4期587-603,共17页信息与电子工程前沿（英文版）

基　　金：Project supported by the National Natural Science Foundation of China(No.61833015)。

摘　　要：With the advent of Industry 4.0,water treatment systems(WTSs)are recognized as typical industrial cyber-physical systems(iCPSs)that are connected to the open Internet.Advanced information technology(IT)benefits the WTS in the aspects of reliability,efficiency,and economy.However,the vulnerabilities exposed in the communication and control infrastructure on the cyber side make WTSs prone to cyber attacks.The traditional IT system oriented defense mechanisms cannot be directly applied in safety-critical WTSs because the availability and real-time requirements are of great importance.In this paper,we propose an entropy-based intrusion detection(EBID)method to thwart cyber attacks against widely used controllers(e.g.,programmable logic controllers)in WTSs to address this issue.Because of the varied WTS operating conditions,there is a high false-positive rate with a static threshold for detection.Therefore,we propose a dynamic threshold adjustment mechanism to improve the performance of EBID.To validate the performance of the proposed approaches,we built a high-fidelity WTS testbed with more than 50 measurement points.We conducted experiments under two attack scenarios with a total of 36attacks,showing that the proposed methods achieved a detection rate of 97.22%and a false alarm rate of 1.67%.

关 键 词：Industrial cyber-physical system Water treatment system Intrusion detection Abnormal state Detection and localization Information theory 

分 类 号：X703[环境科学与工程—环境工程] TP393.08[自动化与计算机技术—计算机应用技术]