[논문]산업제어시스템에서 앙상블 순환신경망 모델을 이용한 비정상 탐지

김효석; 김용민

doi:10.13089/jkiisc.2021.31.3.401

산업제어시스템에서 앙상블 순환신경망 모델을 이용한 비정상 탐지
Abnormal Detection for Industrial Control Systems Using Ensemble Recurrent Neural Networks Model 원문보기

情報保護學會論文誌 = Journal of the Korea Institute of Information Security and Cryptology, v.31 no.3, 2021년, pp.401 - 410

김효석 (전남대학교 정보보안협동과정) , 김용민 (전남대학교 전자상거래전공)

초록
AI-Helper

최근 산업제어시스템은 인터넷에 연결하지 않은 폐쇄적 상태로 운영하는 과거와 달리 원격지에서 데이터를 확인하고 시스템 유지보수를 위해서 개방적 통합적인 스마트한 환경으로 변화하고 있다. 반면에 상호연결성이 증가하는 만큼 산업제어시스템을 대상으로 사이버 공격이 증가함에 따라 산업 공정의 비정상 탐지를 위한 다양한 연구가 진행되고 있다. 산업 공정의 결정적 규칙적인 점을 고려하여 정상데이터만을 학습시킨 탐지 모델의 결과 값과 실제 값을 비교해서 비정상 여부를 판별하는 것이 적절하다고 할 수 있다. 본 논문에서는 HAI 데이터셋 20.07과 21.03을 이용하며, 순환신경망에 게이트 구조가 적용된 GRU 알고리즘으로 서로 다른 타임 스텝을 적용한 모델을 결합하여 앙상블 모델을 생성한다. 그리고 다양한 성능평가 분석을 통해 단일 모델과 앙상블 순환신경망 모델의 탐지 성능을 비교하였으며 제안하는 모델이 산업제어시스템에서 비정상 탐지하는데 더욱 적합한 것으로 확인하였다.

Abstract ▼ AI-Helper

Recently, as cyber attacks targeting industrial control systems increase, various studies are being conducted on the detection of abnormalities in industrial processes. Considering that the industrial process is deterministic and regular, It is appropriate to determine abnormality by comparing the predicted value of the detection model from which normal data is trained and the actual value. In this paper, HAI Datasets 20.07 and 21.03 are used. In addition, an ensemble model is created by combining models that have applied different time steps to Gated Recurrent Units. Then, the detection performance of the single model and the ensemble recurrent neural networks model were compared through various performance evaluation analysis, and It was confirmed that the proposed model is more suitable for abnormal detection in industrial control systems.

주제어

표/그림 (14)

그림 Fig. 1. Operations of ICS
표 Table 1. Comparison of HAI Dataset Versions
그림 Fig. 2. 3-D Time-Series Data
그림 Fig. 3. Proposed Structure for Abnormal detection
그림 Fig. 4. Flow of Detection Model Generation
표 Table 2. Parameters Used for Model
표 Table 3. Feature Selection using Backward Elimination in HAI 20.07 (Remove checked features)
표 Table 4. Evaluation of Detection Performance by Threshold in HAI 20.07
표 Table 5. Feature Selection using Backward Elimination in HAI 21.03 (Remove checked features)
표 Table 6. Evaluation of Detection Performance by Threshold in HAI 21.03
표 Table 7. Performance of Each Model
표 Table 9. eTaPR of the Proposed Model
표 Table 8. Classification Evaluation Metrics of the Proposed Model
그림 Fig. 5. AUC - ROC Curve

참고문헌 (21)

Choi Seungoh and Kim Woo-Nyon, "Cyber-Physical System TestBed Technology Research Trend," Jonornal of The Korea Institute of information Security & Cryptology, 27(2), pp. 46-56, Apr. 2017
Kwon Sungmoon and Shon Taeshik, "SWaT testbed dataset and Abnormal Detection Trend," Jonornal of The Korea Institute of information Security & Cryptology, 29(2), pp. 29-35, Apr. 2019
Keith Stouffer, Victoria Pillitteri, Suzanne Lightman, Marshall Abrams and Adam Hahn, Guide to Industrial Control System Security, NIST SP 800-82, May. 2015
Hyuk-ki Shin, Womyo Le, Jeong-Han Yun, and Hyoungchun Kim, "HAI 1.0: HIL-based Augmented ICS Security Dataset," 13th USENIX Workshop on Cyber Security Experimentation and Test, 2020
ICS(Industrial Control System) Security Dataset Github, "HIL-based Augmented ICS(HAI) Security Dataset", https://github.com/icsdataset/hai (last accessed 01-Apr-2021)
Won-seok Hwang, Jeong-Han Yun, Jonguk Kim, and Hyoungchun Kim, "Time-Series Aware Precision and Recall for Anomaly Detection-Considering Variety of Detection Result and Adresing Ambiguous Labeling," CIKM'19: Procedings of the 28th ACM International Conference on Information and Knowledge Management, 2019
iTrust Labs_Dataset Info - iTrust, "Secure Water Treatment (SWaT)", https://itrust.sutd.edu.sg/itrust-labs_datasets/dataset_info/ (last accessed 15-Nov-2020)
Jonathan Goh, Sridhar Adepu, Marcus Tan and Lee Zi Shan, "Anomaly Detection in Cyber Physical Systems Using Recurrent Neural Networks," 2017 IEEE 18th International Symposium on High Assurance Systems Engineering (HASE), Jan, 2017
Moshe Kravchik and Asaf Shabtai, "Detecting Cyber Attacks in Industrial Control Systems Using Convolutional Neural Networks," Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, Dec, 2018
Simon Duque Anton, Lia Ahrens, Daniel Fraunholz and Hans Dieter Schotten, "Time is of the Essence: Machine Learning-Based Intrusion Detection in Industrial Time Series Data," 2018 IEEE International Conference on Data Mining Workshops (ICDMW), Nov, 2018
Dan Li, Dacheng Chen, Jonathan Goh and See-kiong Ng, "Anomaly Detection with Generative Adversarial Networks for Multivariate Time Series," International Workshop on Big Data, Streams and Heterogeneous Source Mining: Algorithms, Systems, Programming Models and Applications, Jan, 2019
Jonguk Kim, Jeong-Han Yun and Hyoung Chun Kim, "Anomaly Detection for Industrial Control Systems Using Sequence-to-Sequence Neural Networks," Workshop on the Security of Industrial Control Systems & of Cyber-Physical Systems(CyberICPS 2019) in conjunction with ESORICS 2019, Nov, 2019
antoine-lemay Github, "SCADA network datasets", https://github.com/antoine-lemay/Modbus_dataset (last accessed 15-Nov-2020)
Julien Audibert, Pietro Michiardi, Frederic Guyard, Sebastien Marti and Maria A Zuluaga, "USAD: UnSupervised Anomaly Detection on Multivariate Time Series," Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Aug. 2020.
Mokhtari S, Abbaspour A, Yen KK and Sargolzaei A, "A Machine Learning Approach for Anomaly Detection in Industrial Control Systems Based on Measurement Data," Electronics. 10(4), Feb. 2021
Doyeon Kim, Chanwoong Hwang, and Taejin Lee, "Stacked-Autoencoder Based Anomaly Detection with Industrial Control System," Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing. SNPD 2021. Studies in Computational Intelligence, vol. 951, pp. 181-191, Feb. 2021
Xingchao Bian, "Detecting Anomalies in Time-Series Data using Unsupervised Learning and Analysis on Infrequent," Journal of Institute of Korean Electrical and Electronics Engineers, 24(4), pp. 1011-1016, Dec. 2020
Kyunghyun Cho, Bart van Merrienboer, Caglar Gulcehre, Dzmitry Bahdanau, Fethi Bougares, Holger Schwenk and Yoshua Bengio, "Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translation," In Proceedings of the Empirical Methods in Natural Language Processing (EMNLP), Sep, 2014
Nahyeon Ryu, Hyungseok Kim and Pilsung Kang, "Evaluating Variable Selection Techniques for Multivariate Linear Regression," Journal of the Korean Institute of Industrial Engineers, 42(5), pp. 314-326, Oct, 2016

원문보기 상세보기
Google Colaboratory, "Colab Pro", https://colab.research.google.com/notebooks/pro.ipynb (last accessed 01-Apr-2021)
Ilya Loshchilov and Frank Hutter, "Decoupled weight decay regularization," In International Conference on Learning Representations(ICLR), Jan, 2019

내보내기 구분	파일저장 인쇄 메일전송
구성항목	기본정보 상세정보 관리번호, 논문명, 저널/프로시딩명, 저자 , 발행년, 권, 호, 시작페이지, 끝페이지, 발행기관 관리번호, 논문명, 대등논문명, 저자 , 저널/프로시딩명, 발행기관, 발행년, 발행언어, 권, 호, 시작페이지, 끝페이지, ISBN, ISSN, 주제분야, 키워드, 초록(한글), 초록(영문), 저자(소속기관)
저장형식	Text(ASCII format) Excel format RefWorks Direct Export RIS format (for Reference Manager, ProCite, EndNote), Scholar's Aids, Mendeley
메일정보	받는사람 (필수) @ 보내는사람 (선택) @ 제목 내용 KISTI 검색결과 이메일 서비스
안내	총 건의 자료가 검색되었습니다. 다운받으실 자료의 인덱스를 입력하세요. (1-10,000) 검색결과의 순서대로 최대 10,000건 까지 다운로드가 가능합니다. 데이타가 많을 경우 속도가 느려질 수 있습니다.(최대 2~3분 소요) 다운로드 파일은 UTF-8 형태로 저장됩니다. 파일의 내용이 제대로 보이지 않을실 때는 웹브라우저 상단의 보기 -> 인코딩 -> 자동선택 여부를 확인하십시오. ~ Text(ASCII format) Excel format

연합인증