GRU-based Buzzer Ensemble for Abnormal Detection in Industrial Control Systems  

作　　者：Hyo-Seok Kim Chang-Gyoon Lim Sang-Joon Lee Yong-Min Kim 

机构地区：[1]Interdisciplinary Program of Information Security,Chonnam National University,Gwangju,61186,Korea [2]Major in Computer Engineering,Chonnam National University,Yeosu,59626,Korea [3]School of Business Administration,Chonnam National University,Gwangju,61186,Korea [4]Department of Electronic Commerce,Chonnam National University,Yeosu,59626,Korea

出　　处：《Computers, Materials & Continua》2023年第1期1749-1763,共15页计算机、材料和连续体（英文）

基　　金：supported by Institute of Information&communications Technology Planning&Evaluation(IITP)grant funded by Korea government Ministry of Science,ICT(MSIT)(No.2019-0-01343,convergence security core talent training business).

摘　　要：Recently,Industrial Control Systems(ICSs)have been changing from a closed environment to an open environment because of the expansion of digital transformation,smart factories,and Industrial Internet of Things(IIoT).Since security accidents that occur in ICSs can cause national confusion and human casualties,research on detecting abnormalities by using normal operation data learning is being actively conducted.The single technique proposed by existing studies does not detect abnormalities well or provide satisfactory results.In this paper,we propose a GRU-based Buzzer Ensemble for AbnormalDetection(GBE-AD)model for detecting anomalies in industrial control systems to ensure rapid response and process availability.The newly proposed ensemble model of the buzzer method resolves False Negatives(FNs)by complementing the limited range that can be detected in a single model because of the internal models composing GBE-AD.Because the internal models remain suppressed for False Positives(FPs),GBE-AD provides better generalization.In addition,we generated mean prediction error data in GBE-AD and inferred abnormal processes using soft and hard clustering.We confirmed that the detection model’s Time-series Aware Precision(TaP)suppressed FPs at 97.67%.The final performance was 94.04%in an experiment using anHIL-basedAugmented ICS(HAI)Security Dataset(ver.21.03)among public datasets.

关 键 词：Industrial control system abnormal detection ensemble learning HAI dataset 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]