Wednesday, July 3, 2024, 12pm

Industrial control systems (ICS) govern critical infrastructure and processes, such as power generation, chemical processing, and water treatment. Given their widespread impact and their critical nature, there is a strong incentive for adversaries to attack ICS. An adversary that gains access to an ICS network can manipulate its process values to cause physical damage and harm. Machine-learning-based anomaly detection can be used to detect such manipulated data and is a common proposal for defending ICS. To make anomaly detection more effective for ICS, this thesis investigates and proposes solutions to several challenges when applying anomaly detection to an ICS. First, it is unclear what models and methods are best for detecting ICS anomalies; we comprehensively evaluate prior approaches and compare their performance, identifying what strategies were most effective. Second, it is unclear if and how anomaly-detection outputs can be used to diagnose ICS anomalies; we evaluate a variety of approaches for attributing ICS anomalies to the underlying components that were manipulated. Third, we identify fundamental issues with prior anomaly-detection approaches for ICS, and we are investigating how incorporating domain knowledge through graphs can improve current detection and attribution approaches. Finally, to better understand if current anomaly-detection approaches appropriately match the needs of ICS in practice, we are conducting an interview-based study to understand the workflows and perspectives of practitioners that monitor ICS.

Thesis Committee:
Lujo Bauer (Chair)
Eunsuk Kang
Vyas Sekar (CSD/ECE)
Michael Reiter (Duke University)

Additional Information

In Person and Zoom Participation. See announcement.

Event Type: Thesis Proposals
Room Number: In Person and Virtual - ET
Building: Mehrabian Collaborative Innovation Center 2101 and Zoom
Speaker's Name: CLEMENT FUNG
Speaker Website: clementfung.me
Speaker's Professional Title: Ph.D. Student, Ph.D. Program in Societal Computing, Software and Societal Systems Department, Carnegie Mellon University
Talk Title: Proposing Guidelines and Approaches to Make Anomaly Detection More Effective for Industrial Control Systems
Event Poster Title: Poster
Event Poster URL: www.cs.cmu.edu…
For More Information: aroudebu@andrew.cmu.edu | cherold@cs.cmu.edu
Affiliations: Software and Societal Systems Department (S3D)
Organization(s): School of Computer Science