提出一种实时可解释的异常检测方法,用于工业控制系统与水处理系统。
A Giant-Step Baby-Step Classifier For Scalable and Real-Time Anomaly Detection In Industrial Control Systems and Water Treatment Systems
- 通过线性化传感器-执行器关系,实现快速异常检测。
- 毫秒级响应时间,准确率97.72%,能定位异常来源传感器与动作状态。
- 适合对实时性与可解释性要求高的工业安全场景。
工业控制系统的持续监控对于保障自动化控制安全、确保生产过程处于可接受的安全状态至关重要。安全依赖于基于传感器读数的执行动作(电控触发物理运动),这些读数作为决策的基准。及时发现工业控制系统中的异常(攻击、故障或未知状态)对工厂安全运行、人员安全及服务提供安全至关重要。本文提出一种异常检测方法,通过对传感器-执行器关系中的非线性进行精确线性化,因为线性模型更易求解且理论成熟。以典型的水处理测试平台为案例验证,实验表明该方法可在毫秒级完成异常检测,且结果可解释、可追溯。这一速度与可解释性的同步实现,是现有基于AI/ML的可解释性模型难以达到的。本方法能精确定位引发异常的传感器及执行状态。算法在97.72%准确率下将超出安全限值的偏差标记为非异常,说明在安全边界有冗余的情况下,无需高分辨率慢速检测器。
原文摘要 · Abstract (English)
The continuous monitoring of the interactions between cyber-physical components of any industrial control system (ICS) is required to secure automation of the system controls, and to guarantee plant processes are fail-safe and remain in an acceptably safe state. Safety is achieved by managing actuation (where electric signals are used to trigger physical movement), dependent on corresponding sensor readings; used as ground truth in decision making. Timely detection of anomalies (attacks, faults and unascertained states) in ICSs is crucial for the safe running of a plant, the safety of its personnel, and for the safe provision of any services provided. We propose an anomaly detection method that involves accurate linearization of the non-linear forms arising from sensor-actuator(s) relationships, primarily because solving linear models is easier and well understood. We accomplish this by using a well-known water treatment testbed as a use case. Our experiments show millisecond time response to detect anomalies, all of which are explainable and traceable; this simultaneous coupling of detection speed and explainability has not been achieved by other state of the art Artificial Intelligence (AI)/ Machine Learning (ML) models with eXplainable AI (XAI) used for the same purpose. Our methods explainability enables us to pin-point the sensor(s) and the actuation state(s) for which the anomaly was detected. The proposed algorithm showed an accuracy of 97.72% by flagging deviations within safe operation limits as non-anomalous; indicative that slower detectors with highest detection resolution is unnecessary, for systems whose safety boundaries provide leeway within safety limits.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。