This article discusses the network attacks detection in cyber-physical systems using neural networks based on logical rules. The object of the study was cyber-physical systems of varying degrees of heterogeneity. The study purpose is the cyber-physical system functioning process in a normal state and under conditions of network attacks on it. The authors analyzed the most common methods of presenting data circulating in cyber-physical systems and highlighted the main advantages and disadvantages of using each method. The authors also reviewed the most common network attacks detecting methods in cyber-physical systems and identified the advantages and disadvantages of these methods. As a result of the work, taking into account the previous analysis, a method of detecting network attacks in cyber-physical systems based on the use of a rule-based logical neural network was developed, implemented and researched. The authors also evaluated the accuracy of the method.
Cyber-physical system (CPhS) are used in many different sectors and critical infrastructures, including manufacturing, distribution and transportation.
A typical CPhS structure contains remote diagnostic tools, multiple control and redundancy loops, a user interface for input/output, logging, maintenance and supervisory control tools. Often, implementations of these tools are performed on multiple network protocols using multi-layer networking paradigms and architectures.
Control loops typically use data obtained from actuators, sensors, and programmable logic controllers. Sensors in this context are understood as devices that measure some physical quantity, property and/or parameter and then send the resulting data of fixed discrete variables to a logic controller for subsequent processing. Next, the logical controller processes the received data and generates the necessary commands, based on the final algorithms and control and decision-making mechanisms. The received commands are sent to the input of actuators, which are used to control controlled processes.
The end observer (operational engineer) can interact with the input/output and display interfaces to obtain current data about the state of the system. It is also possible to manually configure set values or scheduled events, change control and/or operating algorithms. The user interface can additionally be used for communication with neighboring devices or remote control of the latter. It is common practice to use diagnostic and maintenance utilities to prevent, identify, and resolve abnormal operation or failures.
Often, control loops are executed in a modular hierarchy: they can be either nested or
executed in cascade, while the given values may be indirectly dependent on the values used
between the loops if the system is not implemented in a single-level process execution.
Lowerlevel circuits usually operate continuously from the beginning of the technical process until
its end, and the execution time of a given circuit can range from several machine cycles to
several days. Figure 1 shows a typical logical structure of the CPhS and the operations
performed on it [
When developing the logical structure of the functioning and/or interaction of the CPhS, it is worth observing the principle of isolation: separation of the end-system network from the corporate, enterprise or global network. The functional component of circulating commands in networks varies - access to the global network, mail servers, data exchange and remote access are usually legitimate in an enterprise network, but clearly should not have a place in special-purpose CPhS. In an enterprise network, it is acceptable to lack strict procedures for monitoring the configuration of network equipment, policies for updating and operating software, etc. However, if you allow access to CPhS from the global network, additional risks in the operation of the CPhS could arise: the possibility of network attacks, illegitimate access and changes in functioning, etc.
Practical considerations, such as the cost of setting up a public Internet connection or maintaining a flat network infrastructure, often mean that a connection between the CPhS and corporate networks is required. This connection poses a significant security risk and must be secured. If networks must be connected, it is highly recommended to allow only minimal connections and establish the connection through a firewall and DMZ (Demilitarized Zone). It is recommended to place servers that process CPhS data, which can be accessed from the enterprise network, in a DMZ.
From the above, the following main components of the CPhS security architecture can be
identified [
8. Abnormal operation detection, response and system recovery.
The use of the security mechanisms described above allows you to divide the enterprise network into zones with different security policies, control the flow of information transmitted from one zone to another, and detect unauthorized access to the enterprise network, anomalous conditions and network attacks. Also, thanks to the introduction of defense in depth, it provides a fairly high level of security due to redundancy. However, some CPhS security threats may provide the opportunity for a successful attack even if all of the previously listed security mechanisms are in place. Such threats include: human factor, vulnerabilities of existing protocol implementations, vulnerabilities of firewalls and edge protection equipment, zero-day vulnerabilities, etc. That is, an attacker has the potential to gain full access to the operator’s terminal and manipulate input values to disrupt the normal flow of physical and logical processes of the system.
Thus, attacks are possible in which none of the security mechanisms detects a violation the only data on the basis of which anomalies can be detected are indicators of the current state of processes. Since the restoration of physical processes is extremely difficult and expensive, it is necessary to detect an anomaly as early as possible. This article is dedicated to this task.
Detection of anomalies in the flow of processes on a cyber-physical system of an enterprise can be based on the methods of presenting data within the system. Creating a full-fledged model of complex physical processes is a very non-trivial task: such an approach requires a deep understanding of the system and its implementation, and, consequently, an individual approach to each system separately or to a certain set of typical systems. In practice, they are often limited to methods for detecting anomalous CPhS states, based on methods of data presentation and their processing.
Based on their descriptive nature, methods of presenting data in CPhS can be fundamentally divided into those using: multivariate time series without transformation with subsequent analysis; compressed, aggregated or otherwise processed multivariate time series; fractal representation of the system topology; graph structures of different types.
In [
To predict the state of system components, in [
The authors in [
In [13, 14], the authors use the method of multifractal data analysis to identify anomalies in the traffic of backbone networks. According to the authors, this approach adequately detects network problems or attacks. The values of the characteristics of the multifractal spectrum are used as signal metrics.
The work [15, 16] considers the possibility of using classical graph structures to model the network infrastructure of complex large-scale objects (including critical ones. The authors also supplement classical graphs with the target function of the object and unary operations on the graph, reflecting cyber-attacks.
In works [17, 18], the authors consider a graph-event model for presenting data in CPhS. This approach allows you to analyze the behavior of programs based on events generated during the operation of the system. The authors also present the system architecture and list the events that are monitored at the appropriate levels. Additionally, metrics are analyzed that allow one to evaluate the similarity of the resulting graph and the structure of the graphs of given applications. Experimental results are presented that illustrate the effectiveness and accuracy of the developed approach.
The methods most suitable for CPhS include event graphs, signal graphs and their combination with multidimensional time series. For greater clarity, the main advantages and disadvantages of methods for presenting data in the CPhS, additional notes and other materials are given in Table 1.
Analyzing the mechanisms, tools and mathematical apparatus used in methods for detecting network attacks aimed at CPhS, the following approaches can be distinguished in principle: • • • assessment of system self-similarity criteria; prediction of the system state based on statistical tools; prediction of system state based on machine learning.
Advantages of the first [19, 20] and second methods [21, 22]: • • • • • high speed of processing results; low demands on the system’s computing resources; high accuracy of assessment in short time intervals – positive results in cases of detecting anomalies of short duration.
Disadvantages of the first [19, 20] and second methods [21, 22]: weak analysis or complete absence of analysis in the low-level segment of the system; the difficulty of detecting long-term anomalies, provided they appear smoothly and have a relatively low growth rate.
Advantages of the third method [23, 24, 25]: • • • high variability of the designs used and, as a result, the possibility of choosing between speed, quality and resource requirements of the system; the possibility of the most in-depth and reliable detection of anomalies in the system low-level segment; the ability to put the most in-depth analysis and improve the level of system security. Disadvantages of the method [23, 24, 25]: initial complexity of settings; the need for system training; increased requirements for system resources in comparison with all other solutions; impossibility of transferring the trained model to a new topology (unlike most other approaches), the need for retraining.
Based on the foregoing, the authors recommend focusing on solutions based on the use of machine learning due to increased variability, in particular, artificial neural networks [26].
After a thorough analysis of the existing methods of presenting data in CPhS, the advantages of these methods, their disadvantages and areas of application, we can proceed to the development and implementation of our method of detecting network attacks in CPhS.
The described method is based on processing the received time series from CPhS actuators and sensors, using a logical neural network to predict the following state of the system and calculating the divergence between the predicted and real values.
The data processing and aggregation included the following steps: 1. Assigning identification numbers to each of the devices (id, numbering was performed arbitrarily, but maintaining the logical connection “sender-receiver”). 2. Changing the status indicators for those devices that cannot measure the degree of their "load", but can measure the degree of power discharge.
Considering the previously discussed existing data presentation methods advantages and disadvantages, the authors decided to focus on the use of multivariate time series. The main reasons for this are: used data used variability, the possibility of manual adjustment of the solver parameters and high degree of method variability.
When using multivariate time series, a neural network is usually trained on valid data to predict the system following state and calculate the divergence between the predicted and actual state. By analyzing the divergence, anomalous states in the system are detected.
A classic multivariate time series is the following set: where each value at time is represented by a vector: For ease of use the initial data received from system objects are normalized as follows: = (1), (2), … , ( ) , ( )
( ) = { 1 , 2 , … , ( )
} = − −
The CPhS system under consideration included 3 devices, each with 3 basic characteristics: the object state, the object load, the object physical data measured. Based on these parameters, the load level of a particular device is determined. The system load is determined by the maximum load value among all devices. during 24 hours, includes its operation in a normal state and in anomalous behavior.
The collected statistics became the basis for creating training and test samples.
Based on previous studies, it was evident that multivariate time series are the best used with neural networks due to the fact that the latter have shown quite high accuracy in detecting network attacks when combined with the use of this data description method in CPhS.
To avoid the previously listed disadvantages of using neural networks, especially the initial complexity of settings and the topology compiling complexity of the neural network, the authors was decided to use a rule-based logical neural network.
The structure of this network is shown in Figure 5.
The neural network has 5 inputs, four of which receive data on the load of each device, obtained by converting the characteristics of the device using a clock series. The fifth input supplies data about the current time. The only output of the neural network determines the predicted load value of the system as a whole and, based on this, makes a conclusion about the presence/absence of an attack.
The results of the developed neural network work are presented in the form of surfaces (Fig. 6 and Fig. 7).
Figure 7 Results of work for the ratio device 1/device 3.
The described method is based on processing the resulting multidimensional time series, compiled from data circulating within the CPhS, predicting the following state of the system using a logical neural network and analyzing the divergence that arise - the discrepancies between the real values of the system state and the predicted ones.
The methods include 2 stages - preparatory and working. The preparatory stage is aimed at automatically training the neural network and involves the following steps: 1. Preparation of test data - normalization and compilation of multivariate time series. 2. Transfer of input data in the form of a multidimensional series to the input of a neural network. 3. Training the neural network on the transmitted data until the specified accuracy is achieved on the test data.
The working stage involves the direct detection of network attacks aimed at the CPhS and includes the following steps: 1. Preparation of real data from a functioning CPhS – normalization and compilation of multidimensional time series. 2. Transfer of input data in the form of a multidimensional series to the input of a neural network. 3. Prediction of the following state of the system by a neural network based on inputted multidimensional time series. 4. Calculation of the divergence between the predicted system state and the real one. 5. Recording the presence or absence of attacks on the CPhS based on the received divergence.
As previously noted, data that has undergone the normalization procedure must be preprocessed: for all points in the time series, a predicted value is determined, as shown in Figure 8.
To assess the developed method accuracy, the following parameters were calculated: 1. Accuracy: A = (TP + TN) / (P + N); 2. Precision: Pr = TP / (TP + FP); 3. True Positive Rate: = TP / (TP + FN); 4. True Negative Rate: = TN / (TN + FP); 5. False Positive Rate: = FP / (FP + TN); 6. False Negative Rate: = FN / (FN + TP); 7. Positive Predictive: = 1 − FP / (FP + TP); 8. Negative Predictive: = TN / (TN + FN); 9. F-Score = 2 / (2 + + ); where TP – the number of correct detections system normal state (True Positive); TN – number of correct detections of attacks on the system (True Negative); FP – number of unrecognized attacks (False Positive); FN – the normal system states number recognized as attacks (False Negative); P – total number of normal CPhS states (Positive); N – total number of CPhS states, including attacks (Negative).
Below are the values for all considered time periods in the form of tables. These values are broken down by attack type. After each table with the results of calculations, the authors give conclusions about the accuracy of the developed method.
On the segment without attacks, the overall accuracy (Precision) turned out to be equal to one. According to the authors, this result is due to the false positives (FP) absence, since there were no attacks in this segment. The closeness of the solution (accuracy) allowed the authors to conclude that some disagreement (FN) was present – but the model was not retrained.
Analyzing the “DoS attack” segment, we can say that here the method showed positive results. These are confirmed by high closeness of solutions (Accuracy) and high general accuracy of classification (Precision). False Positive Rate is less than 0.1 and False Negative Rate is less than 0.1, both are very close to each other. This indicates that the false detection rate is a small fraction of the total number of attacks.
All Positive
Negative True Positive True Negative False Positive False Negative Values
Values 0,79 0,84 0,84 0,70 0,30 0,16 0,84 0,71 0,84
In the segment with Backdoor attacks, the method showed the lowest accuracy (Precision) and proximity of solutions (Accuracy). About a third of the attacks were incorrectly classified by the system as a normal CPhS state. The authors explain this by the fact that in this case, backdoor attacks were understood as resending the package after certain time intervals. To improve the performance of the method, the authors recommend using additional attack detection criteria or using an event handler to retransmit previously received packets.
The work results are the development, implementation and research of the implemented method of detecting network attacks in the CPhS. The method involves using a rule-based logical neural network.
Detection of network attacks carried out on the CPhS consists of the following stages: 1. Data are processed and presented in the form of multidimensional time series 2. Developing a neural network based on the plural of rules. 3. Training a developed neural network on a test samples. 4. Prediction of the following state of the system. 5. Calculation of the divergence between the predicted and actual states of the system.
The average value of accuracy (Precision; 0.91) and proximity of solutions (Accuracy; 0.87), as well as the values of False Positive Rate (0.13) and False Negative Rate (0.11) indicate the absence of model overtraining and the method high reliability. [13] P. Dymora, M. Mazurek. An Innovative Approach to Anomaly Detection in Communication Networks Using Multifractal Analysis. Appl. Sci. 2020, 10(9), 3277; doi:10.3390/app10093277. [14] G. Sebestyen, A.Hangan. Anomaly detection techniques in cyber-physical systems. Acta
Universitatis Sapientiae, Informatica. 2017. 9. doi:10.1515/ausi-2017-0007. [15] A. Kott, M. Lange, J. Ludwig. “Approaches to Modeling the Impact of Cyber Attacks on a
Mission”. 2017. [16] A. Presekal, A. Stefanov, V. Rajkumar, P. Palensky. Attack Graph Model for CyberPhysical Power Systems Using Hybrid Deep Learning. IEEE Transactions on Smart Grid. 2023. PP. 1-1. 10.1109/TSG.2023.3237011. [17] A. Berti, J. Herforth, M.S. Qafari et al. Graph-based feature extraction on object-centric event logs. Int J Data Sci Anal, 2023. doi:10.1007/s41060-023-00428-2 [18] L. F. Sikos. Cybersecurity knowledge graphs. Knowl Inf Syst 65, 3511–3531 (2023).
doi:10.1007/s10115-023-01860-3. [19] D. Crémilleux, Visualization for information system security monitoring. Cryptography and Security [cs.CR]. CentraleSupélec, 2019. English. ffNNT: 2019CSUP0013ff. fftel02872028f [20] Sun Yu, Liu Xiaorong, Shen Xiaoli. “Computer Network Information Security Monitoring System Based on Big Data Era”. Security and Communication Networks. 2022. 1-11. 10.1155/2022/3170164. [21] F. Yiwei, L. Xiaoling. An online Bayesian approach to change-point detection for categorical data. Knowledge-Based Systems. 2020. 196. 105792. doi:10.1016/j.knosys.2020.105792. [22] B. Petrik, V. Dubrovin. “Detection of Dos Attacks in Network Traffic by Wavelet Transform”. Applied Questions of Mathematical Modelling, 2021, 4(1), 186-196. doi:10.32782/KNTU2618-0340/2021.4.1.20 [23] M. F. Safitra, M. Lubis, H.Fakhrurroja. Counterattacking Cyber Threats: A Framework for the Future of Cybersecurity. Sustainability 2023, 15(18), 13369, doi:10.3390/su151813369 [24] W. Wang, F. Harrou, B. Bouyeddou, S.-M. Senouci, Y. Sun. Cyber-attacks detection in industrial systems using artificial intelligence-driven methods. International Journal of Critical Infrastructure Protection, Volume 38, 2022, 100542, ISSN 1874-5482, doi:10.1016/j.ijcip.2022.100542. [25] M. A. Umer, K. N.Junejo, M. T. Jilani, A. P. Mathur. Machine learning for intrusion detection in industrial control systems: Applications, challenges, and recommendations. International Journal of Critical Infrastructure Protection, Volume 38, 2022, 100516, ISSN 1874-5482, doi:10.1016/j.ijcip.2022.100516. [26] E. M. Cherrat, R. Alaoui, H. Bouzahir, Score fusion of finger vein and face for human recognition based on convolutional neural network model. International Journal of Computing, 19(1), 2020, 11-19. doi:10.47839/ijc.19.1.1688