Denial of Service Attack Detection in Case of Tennessee Eastman Challenge Process. (2015)

• Record Type: Journal Article
• Authors: Kiss, István; Haller, Piroska; Bereş, Adela
• Is Part Of: Procedia technology. Volume 19(2015)
• Page Start: 835
• Page End: 841
• Publication Date: 2015
• Subjects: cyber-physical security -- clustering -- data mining -- intrusion detection -- secure control -- anomaly detection; Technology -- Congresses; Technology -- Periodicals; Engineering -- Congresses; Engineering -- Periodicals; Engineering; Technology; Conference proceedings; Periodicals; 605
• DOI: 10.1016/j.protcy.2015.02.120
• Languages: English
• ISSNs: 2212-0173

Abstract

Abstract: Recently the operation of modern industrial equipment increasingly tends to rely on networked cyber systems, which grant full access to the physical devices. Therefore, these kinds of systems are exposed to intelligent cyber attacks aimed to disrupt the stable operation of commonly named modern Networked Critical Infrastructures (NCI). We chose the Tennessee Eastman plant-wide challenge process (TEP) as representing a NCI controlled by an industrial control system (ICS). In order to ensure the security and to maintain the stability of NCI, new cyber attack detection methods are necessary. We propose a clustering based approach for detecting the influences of cyber attacks, especially those of denial of service (DoS) attacks, in the observed process data. The abnormal process behavior is identified by clustering the feature data points that describe the actual operation of the system. The proposed approach is presented in contrast with TEP, therefore several scenarios of DoS attack are experimented to validate the effectiveness of the method.