Decision tree based invariants for intrusion detection in industrial control system

The proliferation of interconnected Industrial Control Systems (ICS) and their connectivity with internet is expanding the attack surface, making them vulnerable to cyber-threats such as ransomware, malware, and targeted attacks. A cyber-attack launched on a critical infrastructure (CI), such as a water treatment plant, chemical plants or power grid could lead to anomalous behavior. Due to dynamic nature and variety of attributes in cyber data, the detection and prevention of these anomalous behavior is still an open challenge. Cyber physical systems (CPS) includes both the information technology (IT) and operational technology (OT) data. The detection of anomalous behavior is possible using both the IT and the OT data. The study conducted here has used the OT data. A supervised machine learning technique based on decision trees was used to mine the invariants from the OT data. The proposed approach was also compared with the Association Rule Mining (ARM) for generating invariants. The entire study was conducted in the context of scaled down version of water distribution plant (WaDi). The validation of generated invariants was performed using the operational plant and also using the physics of the plant.