Attack Detection for Securing Cyber Physical Systems

Cyber-physical systems (CPSs) security has become a critical research topic as more and more CPS applications are making increasing impacts in diverse industrial sectors. Due to the tight interaction between cyber and physical components, CPS security requires a different strategy from the traditional information technology (IT) security. In this paper, we propose a machine learning-based attack detection (AD) scheme, as part of our overall CPS security strategies. The proposed scheme performs AD at the physical layer by modeling and monitoring physics or physical behavior of the physical asset or process. In developing the proposed AD scheme, we devote our efforts on intelligently deriving salient signatures or features out of the large number of noisy physical measurements by leveraging physical knowledge and using advanced machine learning techniques. Such derived features not only capture the physical relationships among the measurements but also have more discriminant power in distinguishing normal and attack activities. In our experimental study for demonstrating the effectiveness of the proposed AD scheme, we consider heavy-duty gas turbines of combined cycle power plants as the CPS application. Using the data from both the high-fidelity simulation and several real plants, we demonstrate that our proposed AD scheme is effective in early detection of attacks or malicious activities.