Anomaly detection for a water treatment system using unsupervised machine learning

• Main Authors: INOUE, Jun, YAMAGATA, Yoriyuki, CHEN, Yuqi, POSKITT, Christopher M., SUN, Jun
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2017
• Subjects: Anomaly detection; Deep neural network; Machine learning; Support vector machine; Water treatment system; Software Engineering
• Online Access: https://ink.library.smu.edu.sg/sis_research/4704; https://ink.library.smu.edu.sg/context/sis_research/article/5707/viewcontent/Anomaly_detection_water_treatment_ICDMW17_av.pdf
• Institution: Singapore Management University

In this paper, we propose and evaluate the application of unsupervised machine learning to anomaly detection for a Cyber-Physical System (CPS). We compare two methods: Deep Neural Networks (DNN) adapted to time series data generated by a CPS, and one-class Support Vector Machines (SVM). These methods are evaluated against data from the Secure Water Treatment (SWaT) testbed, a scaled-down but fully operational raw water purification plant. For both methods, we first train detectors using a log generated by SWaT operating under normal conditions. Then, we evaluate the performance of both methods using a log generated by SWaT operating under 36 different attack scenarios. We find that our DNN generates fewer false positives than our one-class SVM while our SVM detects slightly more anomalies. Overall, our DNN has a slightly better F measure than our SVM. We discuss the characteristics of the DNN and one-class SVM used in this experiment, and compare the advantages and disadvantages of the two methods.