ALUMNAS: Itzel Guadalupe Iturbe López Violeta Mejía Mancilla.
Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a)...
Transcript of Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a)...
![Page 1: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/1.jpg)
LEVERAGING MULTIVARIATEANALYSIS TO DETECT ANOMALIESIN INDUSTRIAL CONTROL SYSTEMSDAT300 presentation
Mikel IturbeElectronics and Computing DepartmentFaculty of Engineering – Mondragon University
Chalmers University of Technology, Gothenburg, SwedenSeptember 15, 2016
![Page 2: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/2.jpg)
<Prologue>
![Page 3: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/3.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
About me
3
![Page 4: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/4.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
About me
• Born in Bilbao, Basque Country, 1987• BSc in Computer Engineering (Mondragon Unibertsitatea2008-2012)
• MSc in ICT Security (UOC, UAB, URV 2012-2013)• PhD in ICS Security (Mondragon Unibertsitatea 2013-2017?)
4
![Page 5: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/5.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
About us: Mondragon Unibertsitatea
• Small, private, non-profit university in the Basque Country• Founded in 1997 (1943)• Some data (14/15)
• 4 faculties• 3513 undergrad students• 615 Master students• 112 PhD students
• Cooperative university• Transfer oriented research
5
![Page 6: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/6.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
About us: Telematics team at Mondragon Unibertsitatea
6
![Page 7: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/7.jpg)
</Prologue>
![Page 8: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/8.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Agenda
1. Introduction
2. Anomaly Detection Systems
3. Multivariate Statistical Process Control
4. Ongoing work
5. Conclusions
8
![Page 9: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/9.jpg)
Introduction
![Page 10: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/10.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Industrial control systems
CC-BY-SA 3.0 Kreuzschnabel, Schmimi1848, Wolkenkratzer, Brian Cantoni, Hermann Luyken, Beroesz
10
![Page 11: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/11.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Fieldbus Network
Control Network
Demilitarized Zone
Corporate Network
Internet
PLC PLCPLC
HMI
ControlServer Engineering
Workstation
HistorianData Server
Field equipment
Workstations
CorporateServers
Fiel
d De
vice
sFi
eld
Cont
rolle
rsSu
perv
isor
y De
vice
s
11
![Page 12: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/12.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
ICS vs. IT
ICS networks IT networks
Primary function Control of physical equip-ment Data processing and transfer
Applicable Domain Manufacturing, processingand utility distribution
Corporate and home environ-ments
HierarchyDeep, functionally separatedhierarchies with many proto-cols and physical standards
Shallow, integrated hierar-chies with uniform protocoland physical standard utili-sation
Failure Severity High LowReliability Required High ModerateRound Trip Times 250μs–10 ms 50+ msDeterminism High Low
Data Composition Small packets of periodic andaperiodic traffic Large, aperiodic packets
Temporal consistency Required Not Required
Operating environmentHostile conditions, often fea-turing high levels of dust,heat and vibration
Clean environments, oftenspecifically intended for sen-sitive equipment
System lifetime (years) Some tens Some
Average node complexity low (simple devices, sensors,actuators)
high (large servers/file sys-tems/databases)
Brendan Galloway and Gerhard Hancke. Introduction to Industrial Control Networks. IEEE Communications Surveys & Tutorials, 15(2):860–880, 2012Manuel Cheminod, Luca Durante, and Adriano Valenzano. Review of Security Issues in Industrial Networks. IEEE Transactions on Industrial Informatics, 9(1):277–293, 2013 12
![Page 13: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/13.jpg)
Anomaly Detection Systems
![Page 14: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/14.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Intrusion Detection System
• Mechanisms that monitor network and/or systemactivities to detect suspicious events that occur in them.
• Main classification criteria in IDSs1. Detection mechanism
• Signature-based• Anomaly Detection Systems (ADS)
2. Scope• Host• Network
3. ICS Scope• Network• Process
14
![Page 15: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/15.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
ADSs on ICSs
• Active research topic• Data-driven methods gaining traction
Bonnie Zhu and Shankar Sastry. SCADA-specific intrusion detection/preventionsystems: a survey and taxonomy. In Proceedings of the 1st Workshop on SecureControl Systems (SCS), 2010
Robert Mitchell and Ingray Chen. A Survey of Intrusion Detection Techniques for CyberPhysical Systems. ACM Computing Surveys, 46(4), April 2014
15
![Page 16: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/16.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Gaps in literature
• We found a couple of relevant gaps in the literature.1. Lack of visualizations2. Almost no network & process level ADSs
16
![Page 17: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/17.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Visual Network Flow Monitoring
(a) Forbidden flow betweenPLC 1 and HMI 2.
(b) Detail of the forbiddenflow.
Mikel Iturbe, Iñaki Garitano, Urko Zurutuza, and Roberto Uribeetxeberria. Visualizing Network Flows and RelatedAnomalies in Industrial Networks using Chord Diagrams and Whitelisting. In Proceedings of the 11th JointConference on Computer Vision, Imaging and Computer Graphics Theory and Applications, volume 2, pages 99–106,Feb. 2016
17
![Page 18: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/18.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Visual Network Flow Monitoring
Able to detect, based on whitelisting:
• Forbidden connection• Forbidden port• Incorrect flow size (DoS)• Missing host
18
![Page 19: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/19.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Gaps in literature
• We found a couple of relevant gaps in the literature.1. Lack of visualizations2. Almost no network & process level ADSs
19
![Page 20: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/20.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Gaps in literature
“In order to make IDSs effective in protecting this kindof systems, it is then needed a set of multilayeraggregation features to correlate events generatedfrom different sources (e.g. correlating events comingfrom the process network of a remote transmissionsubstation with events coming from the officenetwork of a control center) in order to detect largescale complex attacks. This probably represents thenext research challenge in this field.”
Ettore Bompard, Paolo Cuccia, Marcelo Masera, and Igor Nai Fovino. Cyber vulnerabilityin power systems operation and control. In Critical Infrastructure Protection, pages197–234. Springer, 2012
20
![Page 21: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/21.jpg)
Multivariate Statistical Process Control
![Page 22: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/22.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Multivariate data
V1 V2 V3 … VmO1O2O3.........On
• ICSs are multivariate by nature.
22
![Page 23: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/23.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Multivariate data
It is not easy to monitor…
• If variables are in their normal operation constraints• Correlations between different variables
But, information can be expressed in a (smaller) set ofnon-measurable variables called Latent Variables or PrincipalComponents
23
![Page 24: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/24.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Principal Component Analysis (PCA)
CC-BY-SA 2.5 Charles Albert-Lehalle
24
![Page 25: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/25.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Principal Component Analysis (PCA)
• Dimensionality Reduction Algorithm• Linear combination of variables• Maximizes variance
25
![Page 26: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/26.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Principal Component Analysis (PCA)
CC-BY 2.0 Matthias Scholz, Approaches to analyse and interpret biological profile data. PhD Thesis. University ofPotsdam, 2006
26
![Page 27: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/27.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Principal Component Analysis (PCA)
X = TAPtA + EA
O11 . . . O1mO21 . . . O2mO31 . . . O3m...
......
...On1 . . . Onm
=
O′11 O′
12O′21 O′
22O′31 O′
32...
......
...O′n1 O′
n2
[V′11 . . . V’1mV′21 . . . V’2m
]+
e11 . . . e1me21 . . . e2me31 . . . e3m...
......
...en1 . . . enm
27
![Page 28: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/28.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Principal Component Analysis (PCA)
X = TAPtA + EA
O11 . . . O1mO21 . . . O2mO31 . . . O3m...
......
...On1 . . . Onm
Original values
=
O′11 O′
12O′21 O′
22O′31 O′
32...
......
...O′n1 O′
n2
Scores
[V′11 . . . V’1mV′21 . . . V’2m
]Loadings
+
e11 . . . e1me21 . . . e2me31 . . . e3m...
......
...en1 . . . enm
Residuals
28
![Page 29: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/29.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
PCA: Residuals
PD - Pearson, K. 1901. On lines and planes of closest fit to systems of points inspace. Philosophical Magazine 2:559-572.
29
![Page 30: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/30.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Multivariate Statistical Process Control
• Statistical Control• Process-agnostic• We monitor the scores and the residuals on control charts.• Two univariate statistics:
Dn =A∑
a=1
(tan − µta
σta
)2; Qn =
A∑a=1
(enm)2
30
![Page 31: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/31.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Control Charts
Time
Value
31
![Page 32: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/32.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Anomaly Detection
• Monitoring of control charts• If three consecutive observations go of bounds, the eventis flagged as anomalous
32
![Page 33: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/33.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Anomaly Diagnosis
• Once an anomaly is flagged, we diagnose its cause• Contribution (oMEDA) plots
TE variables
d2 A
-90
-80
-70
-60
-50
-40
-30
-20
-10
0
10
XMEAS(1)
José Camacho. Observation-based missing data methods for exploratory data analysis to unveil the connectionbetween observations and variables in latent subspace models. Journal of Chemometrics, 25(11):592–600, 2011
33
![Page 34: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/34.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Application to Network Anomaly Detection
• MSPC-based techniques can be used for network anomalydetection.
• Variable parametrization.• Logs
José Camacho, Gabriel Maciá Fernández, Jesús Díaz Verdejo, and Pedro García Teodoro. Tackling the Big Data 4 vsfor anomaly detection. In Computer Communications Workshops (INFOCOM WKSHPS), 2014 IEEE Conference on,pages 500–505, April 2014. doi: 10.1109/INFCOMW.2014.6849282
José Camacho, Alejandro Pérez Villegas, Pedro García Teodoro, and Gabriel Maciá Fernández. PCA-basedmultivariate statistical network monitoring for anomaly detection. Computers & Security, 59:118–137, 2016. ISSN0167-4048. doi: http://dx.doi.org/10.1016/j.cose.2016.02.008
34
![Page 35: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/35.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
And in ICSs?
• When looking at Process Data, we might be able todistinguish intrusions from disturbances using MSPC
Mikel Iturbe, José Camacho, Iñaki Garitano, Urko Zurutuza, and Roberto Uribeetxeberria. On the feasibility ofdistinguishing between process disturbances and intrusions in process control systems using multivariatestatistical process control. In 2016 46th Annual IEEE/IFIP International Conference on Dependable Systems andNetworks Workshops (DSN 2016), 2016
35
![Page 36: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/36.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Work Hypothesis
Therefore, it seems natural to link both worlds,and create a unified ADS for ICSs.
36
![Page 37: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/37.jpg)
Ongoing work
![Page 38: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/38.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Process: Tennessee-Eastman
James J Downs and Ernest F Vogel. A plant-wide industrial process control problem.Computers & Chemical Engineering, 17(3):245–255, 1993
38
![Page 39: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/39.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Network
39
![Page 40: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/40.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Challenges
• Timestamp synchronization• Data processing complexity
40
![Page 41: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/41.jpg)
Conclusions
![Page 42: Leveraging multivariate analysis to detect anomalies in ......Visual Network Flow Monitoring (a) Forbidden flow between PLC 1 and HMI 2. (b) Detail of the forbidden flow. Mikel Iturbe,](https://reader033.fdocuments.net/reader033/viewer/2022050513/5f9d8c3b68dad316821bdfcc/html5/thumbnails/42.jpg)
Introduction ADSs MSPC Ongoing work Conclusions
Conclusions
• Anomaly Detection in ICSs is an active research field• Security visualizations in the field are still in their infancy• Multivariate Analysis can help finding process-levelanomalies
• Network variable parametrization opens the way to amulti-level, process-agnostic, ADS for ICSs.
42