Denial of Service Attack Detection in Case of Tennessee Eastman Challenge Process. (2015) - Kiss, István; Haller, Piroska; Bereş, Adela
Abstract: Recently the operation of modern industrial equipment increasingly tends to rely on networked cyber systems, which grant full access to the physical devices. Therefore, these kinds of systems are exposed to intelligent cyber attacks aimed to disrupt the stable operation of commonly named modern Networked Critical Infrastructures (NCI). We chose the Tennessee Eastman plant-wide challenge process (TEP) as representing a NCI controlled by an industrial control system (ICS). In order to ensure the security and to maintain the stability of NCI, new cyber attack detection methods are necessary. We propose a clustering based approach for detecting the influences of cyber attacks, especially those of denial of service (DoS) attacks, in the observed process data. The abnormal process behavior is identified by clustering the feature data points that describe the actual operation of the system. The proposed approach is presented in contrast with TEP, therefore several scenarios of DoS attack are experimented to validate the effectiveness of the method.