Partekatu
Gorde erreferentzia
Izenburua
On the Feasibility of Distinguishing Between Process Disturbances and Intrusions in Process Control Systems using Multivariate Statistical Process Control
Argitalpen data
2016Bertsioa
PostprintaDokumentu-mota
Kongresu-ekarpenaKongresu-ekarpenaHizkuntza
IngelesaEskubideak
© 2016 IEEE Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.Sarbidea
Sarbide irekiaArgitaratzailearen bertsioa
http://dx.doi.org/10.1109/DSN-W.2016.32Non argitaratua
Proceedings of the 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN). Toulouse. 28 June- 1 August. IEEE, 2016 xxxArgitaratzailea
IEEEGako-hitzak
process control systemsMultivariate Statistical Process Control
Tennessee-Eastman
Laburpena
Process Control Systems (PCSs) are the operat-ing core of Critical Infrastructures (CIs). As such, anomalydetection has been an active research field to ensure CInormal ... [+]
Process Control Systems (PCSs) are the operat-ing core of Critical Infrastructures (CIs). As such, anomalydetection has been an active research field to ensure CInormal operation. Previous approaches have leveraged networklevel data for anomaly detection, or have disregarded theexistence of process disturbances, thus opening the possibility of mislabelling disturbances as attacks and vice versa. In thispaper we present an anomaly detection and diagnostic systembased on Multivariate Statistical Process Control (MSPC), thataims to distinguish between attacks and disturbances. For this end, we expand traditional MSPC to monitor process leveland controller level data. We evaluate our approach using the Tennessee-Eastman process. Results show that our approachcan be used to distinguish disturbances from intrusions to acertain extent and we conclude that the proposed approach canbe extended with other sources of data for improving results. [-]
