Assessing Model-free Anomaly Detection in Industrial Control Systems Against Generic Concealment Attacks

Abstract

In recent years, a number of model-free process-based anomaly detection schemes for Industrial Control Systems (ICS) were proposed. Model-free anomaly detectors are trained directly from process data and do not require process knowledge. They are validated based on a set of public data with limited attacks present. As result, the resilience of those schemes against general concealment attacks is unclear. In addition, no structured discussion on the properties verified by the detectors exists.

Publication
Proceedings of the Annual Computer Security Applications Conference (ACSAC)