Applied Science, Faculty of
Engineering, School of (Okanagan)
DSpace
UBCO
Gargoum, Sara
Master of Applied Science - MASc
University of British Columbia
With the advent of Industrial Internet of Things and the push towards digitization, industrial control systems have undergone an increase in connectivity, which enables remote monitoring and control. This in turn has led to their increased vulnerability to several cyberattacks. These attacks can have severe consequences, including equipment damage, service disruption, and even compromising public safety. This thesis focuses on a certain type of cyberattacks, called replay attack. A replay attack involves capturing legitimate communication signals between components in an industrial control system and replaying it later to disrupt system operations or perform other attacks. This thesis presents a comprehensive study on the detection of replay attacks on sensor measurements in industrial control systems. Utilising the vast amount of operational data (i.e. sensor measurements) generated by industrial control systems, a novel data-driven two-stage detection and verification framework is proposed. The proposed framework combines statistical techniques, signal processing and deep learning to detect replay attacks on industrial control systems. The first stage of the detection method consists of continuous monitoring of sensor measurements by performing change-point detection based on the corresponding matrix profile. This stage provides an early indicator of a potential replay attack. The second stage provides a validation of whether the detected change-point is due to a replay attack or not. This stage consists of performing time-frequency analysis using short-time Fourier transform to generate a spectrogram, introducing spectral features to the time-series sensor measurements. Then, the spectrogram is split into image frames, creating spectro-temporal features. A Convolutional Long- Short Term Memory based autoencoder (ConvLSTM-AE) is designed to capture these spectro-temporal features in an unsupervised manner, where a replay attack is detected based on the reconstruction error. To evaluate the effectiveness of the proposed detection and verification framework, it is tested on different replay attack scenarios defined, in data generated using the Tennessee Eastman process benchmark simulation system/process.
Data-Driven Detection andVerification of Replay Attacks onIndustrial Control SystemsbySara GargoumB.Sc. Hons., United Arab Emirates University, 2019A THESIS SUBMITTED IN PARTIAL FULFILLMENT OFTHE REQUIREMENTS FOR THE DEGREE OFMASTER OF APPLIED SCIENCEinTHE COLLEGE OF GRADUATE STUDIES(Electrical Engineering)THE UNIVERSITY OF BRITISH COLUMBIA(Okanagan)August 2023© Sara Gargoum, 2023The following individuals certify that they have read, and recommendto the College of Graduate Studies for acceptance, a thesis entitled:Data-Driven Detection and Verification of Replay Attackson Industrial Control Systemssubmitted by Sara Gargoum in partial fulfilment of the requirements of thedegree of Master of Applied ScienceAhmad Al-Dabbagh, School of EngineeringSupervisorChen Feng, School of EngineeringCo-SupervisorAnas Chaaban, School of EngineeringSupervisory Committee MemberZheng Liu, School of EngineeringSupervisory Committee MemberRyozo Nagamune, University of British Columbia - VancouverUniversity ExamineriiAbstractWith the advent of Industrial Internet of Things and the push towardsdigitization, industrial control systems have undergone an increase in con-nectivity, which enables remote monitoring and control. This in turn has ledto their increased vulnerability to several cyberattacks. These attacks canhave severe consequences, including equipment damage, service disruption,and even compromising public safety. This thesis focuses on a certain typeof cyberattacks, called replay attack. A replay attack involves capturinglegitimate communication signals between components in an industrial con-trol system and replaying it later to disrupt system operations or performother attacks.This thesis presents a comprehensive study on the detection of replayattacks on sensor measurements in industrial control systems. Utilising thevast amount of operational data (i.e. sensor measurements) generated byindustrial control systems, a novel data-driven two-stage detection and verifi-cation framework is proposed. The proposed framework combines statisticaltechniques, signal processing and deep learning to detect replay attacks onindustrial control systems. The first stage of the detection method consists ofcontinuous monitoring of sensor measurements by performing change-pointdetection based on the corresponding matrix profile. This stage provides anearly indicator of a potential replay attack. The second stage provides a val-idation of whether the detected change-point is due to a replay attack or not.This stage consists of performing time-frequency analysis using short-timeFourier transform to generate a spectrogram, introducing spectral featuresto the time-series sensor measurements. Then, the spectrogram is split intoimage frames, creating spectro-temporal features. A Convolutional Long-Short Term Memory based autoencoder (ConvLSTM-AE) is designed tocapture these spectro-temporal features in an unsupervised manner, wherea replay attack is detected based on the reconstruction error. To evaluatethe effectiveness of the proposed detection and verification framework, it istested on different replay attack scenarios defined, in data generated usingthe Tennessee Eastman process benchmark simulation system/process.iiiLay SummaryThis thesis is motivated by the importance of cyberattack detection in in-dustrial control systems that are essential for the stable operation of manypractical applications, such as in chemical processing and manufacturingplants, and power and water distribution networks. Specifically, data-drivenreplay attack detection is explored, eliminating the need for an accurate pro-cess model which may be tedious to obtain. However, the attack’s imple-mentation using actual/valid operational data, thus demonstrating normalbehaviour, makes it difficult to detect using basic data-driven methods. Toaddress this challenge, a two-stage detection and verification framework isproposed. The first stage performs real-time monitoring of sensor measure-ments by detecting changes in the time series data patterns. The secondstage verifies the occurrence of a replay attack by introducing a new dimen-sion of features to newly defined time series data. This framework, therefore,eliminates false alarms and offers more practical and reliable intrusion detec-tion in industrial applications. Its effectiveness is demonstrated for severalscenarios, where an attacker may use sensor measurements to implement areplay attack.ivPrefaceThis thesis was prepared under the supervision of Prof. Ahmad Al-Dabbagh and co-supervision of Prof. Chen Feng. Based on the work in thisthesis, a paper has been prepared for submission to a journal as S. Gargoum,N. Yassaie, A. W. Al-Dabbagh, and C. Feng, “A Data-Driven Frameworkfor Verified Detection of Replay Attacks on Industrial Control Systems”.I was the lead author and researcher, responsible for all areas of problemformulation, methodology and analysis, as well as manuscript composition.Co-author, Negar Yassaie, was involved in providong feedback, manuscriptrevisions, as well as proofreading during her time as an M.A.Sc. student inProf. Al-Dabbagh’s group. The work was conducted under the supervisionand guidance of Prof. Ahmad Al-Dabbagh, along with Prof. Chen Feng.Further, part of Chapter 4 is being prepared for submission to a conference.vTable of ContentsAbstract . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iiiLay Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ivPreface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vTable of Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . viList of Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ixList of Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xAcknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . xiDedication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiiChapter 1: Introduction . . . . . . . . . . . . . . . . . . . . . . . 11.1 Background and Motivation . . . . . . . . . . . . . . . . . . . 21.1.1 Categories of Attacks on Industrial Control Systems . 21.1.2 An Example of an Attack Incident on Industrial Con-trol Systems . . . . . . . . . . . . . . . . . . . . . . . . 31.2 Research Challenges and Objectives . . . . . . . . . . . . . . 41.3 Contributions and Thesis Outline . . . . . . . . . . . . . . . . 51.3.1 Contributions . . . . . . . . . . . . . . . . . . . . . . . 51.3.2 Thesis Outline . . . . . . . . . . . . . . . . . . . . . . 6Chapter 2: Literature Review . . . . . . . . . . . . . . . . . . . 72.1 Model-Based Detection Methods . . . . . . . . . . . . . . . . 72.2 Data-Driven Detection Methods . . . . . . . . . . . . . . . . . 82.2.1 Time-stamp Methods . . . . . . . . . . . . . . . . . . 92.2.2 Statistical and Machine Learning Methods . . . . . . . 9viTABLE OF CONTENTS2.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Chapter 3: Problem Formulation . . . . . . . . . . . . . . . . . 113.1 Replay Attack Model . . . . . . . . . . . . . . . . . . . . . . . 123.2 Replay Attack Scenarios . . . . . . . . . . . . . . . . . . . . . 123.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15Chapter 4: Stage I - Real-Time Monitoring of Sensor Mea-surements . . . . . . . . . . . . . . . . . . . . . . . . 174.1 Matrix Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . 174.2 Change-point Detection . . . . . . . . . . . . . . . . . . . . . 194.2.1 Bayesian Online Change-Point Detection . . . . . . . 194.2.2 Change-Point Detection using Statistical Process Con-trol . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224.3 Matrix Profile Change-point Detection . . . . . . . . . . . . . 244.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27Chapter 5: Stage II - Real-Time Verification of Replay Attacks 295.1 Phase I: Spectro-Temporal Feature Extraction . . . . . . . . . 295.1.1 Short-Time Fourier Transform . . . . . . . . . . . . . 305.1.2 Spectrogram Image Frame Generation . . . . . . . . . 325.2 Phase II: Verification of Replay Attack using ConvLSTM-AE 335.2.1 Long Short-Term Memory Neural Networks . . . . . . 345.2.2 Convolutional Long Short-Term Memory Neural Net-works . . . . . . . . . . . . . . . . . . . . . . . . . . . 355.2.3 Autoencoders . . . . . . . . . . . . . . . . . . . . . . . 355.2.4 Proposed ConvLSTM-AE Model . . . . . . . . . . . . 365.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38Chapter 6: Performance Evaluation of a Case Study . . . . . 406.1 Dataset Generation . . . . . . . . . . . . . . . . . . . . . . . . 406.2 Offline ConvLSTM-AE Model Training . . . . . . . . . . . . . 416.3 Real-Time Monitoring of Sensor Measurements . . . . . . . . 446.4 Replay Attack Verification . . . . . . . . . . . . . . . . . . . . 456.5 Performance Evaluation . . . . . . . . . . . . . . . . . . . . . 466.6 Comparison with Some Existing Data-Driven Replay AttackDetection Methods . . . . . . . . . . . . . . . . . . . . . . . . 496.7 Other Design Considerations . . . . . . . . . . . . . . . . . . 506.7.1 Implementation of Stage I with CUSUM for Change-point Detection . . . . . . . . . . . . . . . . . . . . . . 50viiTABLE OF CONTENTS6.7.2 Removal of Matrix Profile and Spectro-Temporal Fea-ture Extraction . . . . . . . . . . . . . . . . . . . . . . 506.7.3 Removal of Fusion Time Series Data . . . . . . . . . . 516.7.4 Effect of Subsequence Length k on Generated MatrixProfile . . . . . . . . . . . . . . . . . . . . . . . . . . . 526.7.5 Effect of Smoothing Factor α on Change-point Detection 526.7.6 Effect of Scaling Factor λ and Number of SpectrogramImage Frames . . . . . . . . . . . . . . . . . . . . . . . 546.7.7 Effect of Overlap O . . . . . . . . . . . . . . . . . . . 546.8 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55Chapter 7: Conclusion . . . . . . . . . . . . . . . . . . . . . . . . 567.1 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567.2 Limitations and Future Research . . . . . . . . . . . . . . . . 56Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58viiiList of TablesTable 2.1 Comparison of Proposed Framework with Existing Data-Driven Replay Attack Detection Methods in Subsec-tion 2.2.2 . . . . . . . . . . . . . . . . . . . . . . . . . 10Table 6.1 Types and Outputs of the Layers of the ConvLSTM-AE Model . . . . . . . . . . . . . . . . . . . . . . . . . 43Table 6.2 Performance Evaluation of Replay Attack Scenarios . . 49Table 6.3 Performance Evaluation of Replay Attack Detectionusing Existing Methods . . . . . . . . . . . . . . . . . 50Table 6.4 Performance Comparison of CUSUM with EWMA . . 50Table 6.5 Comparison of Different Values of α . . . . . . . . . . 54Table 6.6 Comparison of Different Values of Overlap O . . . . . 55ixList of FiguresFigure 1.1 The most prominent cyberattacks on ICS over thepast decade . . . . . . . . . . . . . . . . . . . . . . . . 2Figure 1.2 Cyberattack categories proposed in [5] . . . . . . . . . 3Figure 3.1 Replay attack diagram . . . . . . . . . . . . . . . . . 11Figure 3.2 Example of replay attack performed on reactor tem-perature sensor in the Tennessee Eastman Process . . 14Figure 3.3 The two stages of the proposed replay attack detec-tion and verification framework . . . . . . . . . . . . 16Figure 4.1 The time series data, corresponding matrix profile,and fusion time series of reactor pressure sensor mea-surements . . . . . . . . . . . . . . . . . . . . . . . . . 26Figure 5.1 Spectro-temporal feature extraction schematic . . . . 31Figure 5.2 LSTM cell structure showing the input, output, andforget gates . . . . . . . . . . . . . . . . . . . . . . . . 34Figure 5.3 Replay attack verification using ConvLSTM-AE . . . 36Figure 6.1 Spectrogram generated for normal data and replayattack data of Scenario 2 . . . . . . . . . . . . . . . . 42Figure 6.2 Regularity score plots for the four replay attack sce-narios . . . . . . . . . . . . . . . . . . . . . . . . . . . 47Figure 6.3 Replay attack detection results using only time seriesreactor pressure measurements . . . . . . . . . . . . . 51Figure 6.4 Spectrogram generated for original time series dataand fusion time series data, with a replay attack ofScenario 1 . . . . . . . . . . . . . . . . . . . . . . . . 53xAcknowledgementsFirst and foremost, all praise goes to Allah for providing me with thisjourney full of knowledge and growth.I would like to express my gratitude to my supervisor Prof. Ahmad Al-Dabbagh and co-supervisor Prof. Chen Feng for their continuous guidanceand support throughout this degree. They contributed to the developmentof my research and technical writing skills, providing me with invaluableknowledge in these areas.My sincere thanks are extended to Prof. Anas Chaaban and Prof. ZhengLiu for kindly willing to serve on my supervisory committee, and to Prof.Ryozo Nagamune for graciously being my university examiner. I am alsograteful to Blockchain@UBC for granting me the opportunity to be part oftheir Blockchain Graduate Training Path.I would also like to express my appreciation to all my friends for theirencouragement and moral support. A special mention goes to my cousin,Nada, for being there for me.Finally, but most importantly, I would like to express my immense grat-itude and appreciation for my parents and siblings. No words are enoughto describe how grateful I am for my extraordinary mother, who instilled inme the value of the pursuit of knowledge and the commitment to hard work.I will also be forever indebted to my father for his unconditional supportand guidance. He is the one who taught me to never settle for anything butthe best. My appreciation is not complete without acknowledging my sister,Amna, who has been there for me in every possible way. I am also grate-ful for my brother Suliman, who I deeply admire and look up to, and mybrother Mohamed, who is an inspiration in his will-power and endurance.xiDedicationTo my dear parents, Salma Feituri and Ali Gargoum, I’d be nowherewithout you.xiiChapter 1IntroductionIndustrial control systems (ICS) are a critical component of modern in-dustrial processes. They ensure the stable operation of a physical industrialfacility through monitoring, controlling, and managing various processes.ICS support large-scale production in various industrial sectors such as man-ufacturing, chemical, oil & gas refineries, and transportation. Moreover,ICS drives the development of various advancements, such as smart cities.The inter-connectivity of ICS through wired and wireless communicationnetworks makes them vulnerable to a wide range of cyberattacks, where amalicious attacker can remotely access the system through the communica-tion network. Such attacks can lead to financial loss, physical equipmentdamage, or even human casualties [1]. Numerous cyberattack incidents withdrastic impacts have been reported in recent years, including the infamousStuxnet malware which infected industrial computer systems at a nuclearfacility in Iran causing severe damage to centrifuges, the BlackEnergy mal-ware attack on a power grid in Ukraine causing a large-scale power outage,and attacks on one of the world’s largest energy companies, Aramco in SaudiArabia [2]. Fig. 1.1 shows some of the most prominent cyberattacks on ICSover the past decade. A total of 4436 ICS-affecting attacks were identifiedin ICS-CERT advisories between 2010 and 2021 [3]. In 2022, there was an87% jump in the ransomware attacks on industrial organisations and a 35%increase in the number of ransomware groups targeting ICS [4].11.1. BACKGROUND AND MOTIVATIONDUQUAn attacktargeting ICSmanufacturersCOLONIALPIPELINE ATTACKRansomware infectioncausing a $5M dollarloss and increasing gaspricesNEW YORK DAMAn Iraniancyberattack targetingBowmanDam in New YorkDRAGONFLYAn ongoingattack on theenergy sectoruncovered bySymantec 2011 2012 2013 2014 2017 2018 20212010HAVEXAn ICS-focusedmalware campaignTRITONA sophisticatedmalware targetingindustrial safetysystems in theMiddle EastFLORIDAWATER TREATMENTHacker manipulatingwater’s chemicaltreatment levels leadingto major health & safetyissuesSTUXNETImplementedusing USB flashdrive to shutdown Iran’snuclear powerplant SHAMOONMalware targeting alarge energy company(Aramco)BLACKENERGYMalware that targetedhuman-machineinterfaces (HMIs) inICSsTSMCProduction line damagedue to ransomwareinfection ($250M damage)Figure 1.1: The most prominent cyberattacks on ICS over the past decade1.1 Background and Motivation1.1.1 Categories of Attacks on Industrial Control SystemsAttacks on ICS can be categorised based on the attacker’s, (i) knowledgeof the process/system model, (ii) disclosure resources, and (iii) disruptionresources as shown in Fig. 1.2 [5]. The attacker’s knowledge can enable thedesign of complex attacks, such as covert attacks [6]. Disclosure resourcesallow the attacker to eavesdrop and obtain system information. Finally,disruption resources are used to affect the operation of the system. Forexample, in Denial of Service (DoS) attacks [7], the transmission of data isblocked. Some attacks, such as deception attacks [8], require a combinationof resources. Common examples of deception attacks are false data injection(FDI) attacks and replay attacks. Both FDI and replay attacks constitutethe alteration of the originally transmitted data. However, in replay attacks,original data is replaced by previously recorded data for a specific period oftime, requiring both disclosure and disruption resources.21.1. BACKGROUND AND MOTIVATIONDisclosure ResourceDisruption ResourceModel KnowledgeZeroDynamicAttackBiasInjectionAttackDOSAttackCovertAttackEavesdroppingAttackReplayAttackFigure 1.2: Cyberattack categories proposed in [5]1.1.2 An Example of an Attack Incident on IndustrialControl SystemsOne of the most sophisticated cyberattack incidents is the Stuxnet attackon the nuclear facilities in Iran in 2010. It was designed to manipulate andsabotage industrial control systems in charge of the uranium enrichmentprocess. To compromise the systems, it used several attack vectors andzero-day vulnerabilities. Specifically, one of the attacks employed was areplay attack on the Programmable Logic Controllers (PLCs). The replayattack encompassed repeating sensor measurements to the SCADA systemto stealthily hide while executing malicious control commands to destroythe nuclear centrifuges. Stuxnet specifically targeted the Siemens Step 7software, which is commonly used to program and configure ICS, includingPLCs. The attackers exploited a vulnerability in the way Step 7 softwarehandled specific code blocks, known as function blocks.31.2. RESEARCH CHALLENGES AND OBJECTIVESStuxnet was introduced into the target facility, possibly through infectedUSB drives or network infiltration [9]. Once inside the network, the malwarestarted its reconnaissance phase, searching for specific ICS and PLCs asso-ciated with the centrifuges. Subsequently, Stuxnet intercepted and recordedlegitimate control system commands sent by the operators to the PLCs.This involved capturing the specific command sequences and associated pa-rameters used to control the centrifuges. The function blocks, which wereresponsible for controlling the speed and operation of the centrifuges, havebeen modified within the Step 7 software. The malware injected its ma-licious code into the function blocks to achieve the desired manipulation.As a final step, Stuxnet repeats previously recorded legitimate sensor mea-surements to the SCADA system, suggesting normal opearation to the op-erators. During the attack sequence, legitimate code continues to executebut receives fake input values, and any output (actuator) manipulations oflegitimate control logic no longer have any effect. Through the replayedmeasurements and modified code blocks, Stuxnet manipulated the speed ofthe centrifuges. The malware increased and decreased the rotational speedof the centrifuges at specific intervals and patterns. This caused physicalstress on the centrifuges, leading to mechanical failures and disrupting theuranium enrichment process.By employing replay attacks, Stuxnet evaded detection and raised min-imal suspicion since it leveraged the legitimate commands used by the op-erators. The attackers were able to manipulate the ICS without triggeringalarms or alerting the facility operators until significant damage had alreadyoccurred. Stuxnet’s utilisation of replay attacks on the Siemens Step 7 soft-ware was one of the key tactics that made the attack highly sophisticatedand effective in sabotaging the centrifuges at the target facility.1.2 Research Challenges and ObjectivesData-driven replay attack detection poses several challenges. The mainchallenge is the ability to differentiate between replay attack sensor mea-surements and normal sensor measurements using time series data. Replayattacks, known for their stealthiness, do not exhibit anomolous behaviourin the sensor measurements, making them difficult to detect. Furthermore,given the real-time monitoring and detection requirements of ICS to preventand mitigate potential attacks, it is crucial for the replay attack detectionmethod to efficiently handle the large volumes of data generated by ICS.Another challenge lies in acquiring labelled data for previous attacks, ne-41.3. CONTRIBUTIONS AND THESIS OUTLINEcessitating the data-driven detection method to be independent of attackdata.To address these challenges, the objective of this thesis is to propose anovel data-driven replay attack detection framework. The framework aimsto be implemented in real-time and perform replay attack detection basedon features that are distinct to the attacks.1.3 Contributions and Thesis Outline1.3.1 ContributionsThis thesis proposes a novel two-stage replay attack detection and veri-fication framework with the following contributions:1. A real-time early detection approach is proposed which entails contin-uous monitoring of sensor measurements through an unconventionalapproach of change-point detection on their time series matrix pro-file, instead of their raw time series data. The change-point detectionis performed using exponentially weighted moving average (EWMA),identifying points that represent a change in the pattern of the timeseries data. Accordingly, new fusion time series data is generatedas a combination of the original sensor measurements and their cor-responding matrix profile. This emphasises the patterns relevant toreplay attacks.2. A replay attack verification algorithm is proposed through which dis-tinct features of replay attacks are extracted by performing time-frequency analysis and introducing spectral features to the fusion timeseries data, extracting spectro-temporal features. To the best of theauthor’s knowledge, the proposed framework is the first to attemptreplay attack detection by treating the replay attack as a spectro-temporal event (i.e., analysing the event in both the time and fre-quency domains) as opposed to analysing raw time series data. This isperformed by applying short-time Fourier transform on the fusion timeseries data to obtain a 2D time-frequency short-time Fourier transformmatrix.3. This work is also the first to perform image-based replay attack de-tection. The 2D matrix results are visualised as spectrograms andconverted into spectrogram image frames, providing spectro-temporalfeatures based on the sensor measurements.51.3. CONTRIBUTIONS AND THESIS OUTLINE4. Developing a ConvLSTM neural network in an autoencoder architec-ture to analyse the spectrogram image frames and extract spectro-temporal features. The ConvLSTM-AE model is trained using spec-trogram image frames of normal/nominal raw time series data (i.e.,attack-free) to provide a latent representation, based on which replayattacks are detected using a defined reconstruction error. Comparedto detection using raw time series data, image-based detection is com-putationally efficient.5. Four different practical scenarios of replay attacks are defined and anal-ysed using the proposed detection and verification framework, demon-strating its practicality and effectiveness using the Tennessee Eastmanprocess benchmark simulation system/model.1.3.2 Thesis OutlineThe thesis is organised as follows.− Chapter 2 provides a comprehensive literature review of existing replayattack detection methods, exploring both model-based and data-drivendetection methods.− Chapter 3 presents the replay attack formulation and defines differentreplay attack scenarios.− In Chapter 4, the first stage of the detection and verification frameworkis described.− Chapter 5 describes the second stage of the detection and verificationframework.− In Chapter 6, the proposed framework is evaluated through a casestudy using the Tennessee Eastman process.− Chapter 7 concludes the thesis, providing a summary of the thesisthrough the contributions made. This chapter also suggests futurework that can be undertaken to address the limitations of the proposedframework.6Chapter 2Literature ReviewReplay attacks are considered very dangerous, as they may potentiallyallow for the undetected execution of other types of attacks. For example,part of the Stuxnet attack encompassed repeating sensor measurements tothe SCADA system to stealthily hide while executing malicious control com-mands to destroy the nuclear centrifuges [10]. Although traditional alarmsystems/configurations are an essential part of ICS which alert human op-erators of faults and abnormalities [11, 12], they are not typically capable ofdealing with cyberattacks, thus requiring dedicated intrusion detection sys-tems [13]. Accordingly, researchers have been highly interested in developingdetection methods for cyberattacks in ICS.This chapter presents a literature review of the existing methods for re-play attack detection in industrial control systems. Replay attack detectionmethods can be categorized as model-based, data-driven, or a combinationof both. Section 2.1 discusses the model-based detection methods, whileSection 2.2 explores the data-driven detection methods.2.1 Model-Based Detection MethodsModel-based methods rely on system knowledge to establish a parame-terised model of the process. With respect to replay attacks, one of the mostcommon model-based detection methods is using watermarking signals. Theprimary focus of these detection methods revolves around employing activedetection strategies through the injection of arbitrary probing signals intocontrol inputs. The underlying principle behind detection is straightfor-ward. When the targeted system operates under normal conditions, thechosen probing signals manifest their effects in the output signals. Con-versely, if the output signals deviate from expected values, the detectorsconclude that the sensor data is fraudulent. The work in [14] presented theearliest replay attack formulation and proposed a detection scheme basedon the injection of a noisy authentication signal, affecting the control per-formance. Similarly in [10], Gaussian noise signals were added to optimalcontrol inputs, and the detector observed the effect of watermarking signals.72.2. DATA-DRIVEN DETECTION METHODSThe authors of [15] showed that a watermarking scheme can be used indetecting sensor attacks in network control systems with several communi-cation nodes. Another watermarking strategy was proposed in [16] throughan event-triggered control scheme. In [17], a replay attack detection methodusing harmonic oscillation signals was proposed. To induce the oscillation,the authors introduced a non-linear function into the control loop as a delib-erate measure, and excitation signals were inserted into the control inputs inan arbitrary manner. Through designed signal processing filters, detectorscan determine whether sensor signals are normal. The approach proposed in[18] introduced a stochastic coding scheme that encoded a Gaussian signalinto the channels used for transmission between the sensors and processors.This coding scheme created a discrepancy in the covariance of the compro-mised data. As a result, the problem of detecting replay attacks has beenreframed as a task of distinguishing the changes in covariance within com-promised systems. In [19], the authors proposed a detection method basedon the injection of sinusoidal waves of time-varying frequency into controlinputs. Several types of bandpass filters were designed in the individualoutputs, and the detectors observed frequency variations. The authors in[20] performed replay attack detection by injecting zonotopic noisy controlinput signals. Despite the performance of these methods in detecting replayattacks, they need an accurate model of the process to perform attack de-tection, which poses practical limitations, as such information is not alwaysavailable and may be cumbersome to obtain.2.2 Data-Driven Detection MethodsAlternatively, researchers have been focusing on data-driven detectionmethods, which rely on historical operational data (e.g., transmitted sensormeasurements) that can be readily obtained through ICS. However, mostavailable research works focus on attacks such as DoS and FDI attacks. Forexample, the work in [21] proposed an attention-based temporal convolu-tional denoising autoencoder to detect DoS and FDI attacks by capturingspatio-temporal information. Both [22] and [23] presented ensemble deeplearning frameworks to detect attacks in industrial control systems. In [24],1D convolutional neural networks and autoencoders were used to detect theattacks in industrial control systems. In comparison to these attacks, replyattacks can become harder to detect using data-driven methods. This isdue to the nature of the attack, where actual/valid operational data is used,thus demonstrating normal behaviour. Consequently, this has led to a few82.2. DATA-DRIVEN DETECTION METHODSnumber of studies in this area.2.2.1 Time-stamp MethodsA common approach to replay attack detection is using time-stampschemes. For instance, [25] introduced a replay attack detection methodthat utilised time-stamp technology. However, the authors in [26] showedthat attackers have the capability to intercept network data and manipulatethe time-stamp, thereby compromising the effectiveness of the method. Ina subsequent work [27], an improved time-stamp scheme was devised specif-ically for ZigBee networks, aiming to mitigate the impact of replay attacks.This enhanced scheme effectively maintained low power consumption withinthe system. Nevertheless, due to potential accidental discrepancies in theclocks of message senders and receivers, legitimate messages might be mis-takenly identified as replay attacks, leading to the loss of valid information.2.2.2 Statistical and Machine Learning MethodsStatistical and machine learning methods are the most common and ef-fective techniques used for data-driven attack detection. These methodsleverage the power of data analysis and pattern recognition to identify ma-licious activities, including replay attacks. In [28], a statistical anomalydetection method based on a Gaussian Mixture Model (GMM) was studied,where attack data is identified based on GMM clustering. The clustering isassessed by the silhouette technique that delivers a numerical measure of thepresence or absence of cyberattacks. Another statistical detection methodwas proposed in [29], where attack detection was performed by monitoringthe change in the histogram of the data. The proposed detection methodfollows the notion that cyber-physical systems possess well-defined dynam-ics that are affected by quasistationary noise, which allows the histogramsequences of the system data packets to converge to different distributionsunder the presence of the attack. In [30], support vector data descriptionwas used to classify replay attacks according to the permutation entropy ofsensor measurements. Permutation entropy is utilised to characterise the de-creasing regularity of the complexity of sensor data that results when replayattacks occur. The significant change in permutation entropy indicated theoccurrence of replay attacks. Similarly, the authors in [31] performed replayattack detection using transfer entropy based causality countermeasures.The detection is performed based on the hindsight that a signal affectedby an attack would unlikely maintain the original causal relationship with92.3. SUMMARYother signals in the control system, which is reflected in the transfer entropy.The authors in [32] used Support Vector Machine to detect replay attacksin power systems based on self-correlation coefficients. The self-correlationcoefficient was utilised to differentiate the replayed power states from thenormal ones in a power system. In [33], Long Short-Term Memory (LSTM)Recurrent Neural Network was used to detect data injection attacks, in-cluding replay attacks. A Euclidean detector is used to verify the degreeof deviation between the predicted value and observed sensor value by theEuclidean distance, based on which an attack is detected.Based on the few studies that exist, data-driven replay attack detectionmethods have shortcomings in terms ofi Accounting for the occurrence time of the replay attackii Implementing real-time detection of the replay attackiii Using distinct features caused by the replay attackiv Considering different replay attack scenariosv Verifying the detection of the replay attack to reduce false alarms2.3 SummaryThis chapter presents a review of replay attack detection methods inthe literature, classified into two main categories: model-based and data-driven approaches. Notably, data-driven methods have gained significantattention among researchers. However, despite their popularity, the existingmethods for replay attack detection exhibit certain limitations. To overcomethese shortcomings, this thesis proposes a novel framework that addressesthe identified challenges in replay attack detection. Comparisons with theexisting literature are provided in Table 2.1.Table 2.1: Comparison of Proposed Framework with Existing Data-DrivenReplay Attack Detection Methods in Subsection 2.2.2Framework Shortcoming (i) Shortcoming (ii) Shortcoming (iii) Shortcoming (iv) Shortcoming (v)[28] ✗ ✗ ✗ ✗ ✗[29] ✓ ✓ ✗ ✗ ✗[30] ✓ ✗ ✗ ✗ ✗[31] ✓ ✗ ✗ ✗ ✗[32] ✓ ✗ ✗ ✗ ✗[33] ✓ ✗ ✗ ✗ ✗This paper ✓ ✓ ✓ ✓ ✓10Chapter 3Problem FormulationThis thesis focuses on detecting replay attacks performed on sensor mea-surements in an industrial control system. Fig. 3.1 shows two possible casesof the replay attack, namely (1) an attack on sensor measurements betweensensors and controllers, or (2) an attack on sensor measurements betweenthe controller and human-machine interface (i.e., operator).Consider a single sensor, its measurements y(t) can be described as timeseries data in the following form:Y = {y(t), t ∈ I} (3.1)where each element y(t) represents a measurement of the sensor at timeinstant t, and I represents the interval of the complete time series data.The historical normal time series data is denoted with superscript 0 (e.g.,Y 0).Human-Machine InterfaceController SensorProcessActuatorsCommunication NetworkReplayReplayAttackerRecord2AttackerRecord1Figure 3.1: Replay attack diagram113.1. REPLAY ATTACK MODEL3.1 Replay Attack ModelUnder the assumption that an adversary has access to the communica-tion network and can manipulate sensor measurements, a replay attack isperformed through two stages, similar to the definitions in the literature(e.g., in [34]). During the first stage, the adversary intercepts traffic andrecords a sequence of sensor measurements y(t) for a specific time intervaldenoted by Irecord = [trecord, trecord + T ], where trecord and T represent thestart time of the recorded data and the period of recording, respectively.The recorded data are represented asyr(t) = y(t), t ∈ Irecord (3.2)The second stage of the attack involves the injection of the recordedsequence of data during interval Iattack = [tattack, tattack +NT ], where tattackrepresents the replay attack start time and N ∈ N is the number of timesthe recorded sequence of period T is repeated. For N = 1, the replayattack is referred to as a delay replay attack. Typically, an adversary canmerely record data for a limited period of time T before injecting the attack.Nonetheless, a replay attack can be achieved by even a short-recorded datasequence by repeating it N times for the intended attack interval. Theattack signal ya(t) is represented as follows:ya(t) = yr(t), t ∈ Iattack (3.3)3.2 Replay Attack ScenariosBased on these attack definitions, four replay attack scenarios are de-fined, which can be addressed by the proposed detection and verificationframework.1. Scenario 1 (N = 1): The replay attack is performed by retransmittingthe recorded sequence only once. Therefore, this scenario represents adelay replay attack.2. Scenario 2 (N > 1): The replay attack is performed by retransmittingthe recorded sequence multiple times.3. Scenario 3: The replay attack is performed by manipulating the recordedsensor measurements to perform a stealthy attack. For this scenario,the attack signal in (3.3) can be reformulated as follow:ya(t) = g(yr(t)), t ∈ Iattack (3.4)123.2. REPLAY ATTACK SCENARIOSwhere Iattack = [tattack, tattack + NT ] and g(·) represents the manipu-lation function. In this thesis, it is assumed that the manipulation isperformed by randomising the order of the recorded sensor measure-ments.4. Scenario 4: The replay attack is performed after a fault has occurredin the process. The purpose of this scenario is to demonstrate theproposed detection and verification framework’s capability in differ-entiating between replay attacks and other process disturbances (i.e.,faults).Remark: It is important to note that in this thesis, for the purposeof simplicity, only attacks on a single sensor measurement at a time areconsidered. However, it is possible that a replay attack is performed onmore than one sensor measurement.Fig. 3.2 shows an example of two replay attack scenarios performed onthe reactor temperature sensor in the Tennessee Eastman process. Fig. 3.2(a)shows a scenario of a stealthy replay attack. In order to achieve a stealthyreplay attack, the ICS is assumed to be in steady state [35]. Following thereplay attack model presented, the data of period T = 0.25, representing 500temperature samples, is first recorded at trecord = 3 hours for the intervalIrecord = [3, 3.25]. Then, the attack is executed at time tattack = 10, by re-peating the recorded data for N = 80, having Iattack = [10, 30]. As shown inthe figure, the attack causes fluctuations in the temperature values, denotedas y(t), that are not observed as the attacker repeats the previously recordedmeasurements instead, denoted as ya(t). After the attack, the temperaturesensor readings go back to normal.Fig. 3.2(b) shows a scenario of a replay attack that causes a shutdown.In this scenario, data of period T = 0.25 is first recorded at trecord = 0.5hours for the interval Irecord = [0.5, 0.75]. Similar to the previous scenario,the attack is executed at time tattack = 10 hours, by repeating the recordeddata for N = 80, having Iattack = [10, 30]. The effect of the attack on thecontrol loop causes a significant drop in the temperature values which isnot observed until a shutdown occurs, due to the replay attack. From thisexample, it can be seen how the choice of trecord can result in a differentreplay attack effect.133.2. REPLAY ATTACK SCENARIOS0 10 20 30 40 50Time, t [hrs]117.5120.0122.5125.0127.5130.0132.5135.0Temperatureya(t)y(t)10 12 14122.875122.900122.925(a) Stealthy0 2 4 6 8 10 12 14Time, t [hrs]100105110115120Temperatureya(t)y(t)10 12122.875122.900122.925(b) ShutdownFigure 3.2: Example of replay attack performed on reactor temperaturesensor in the Tennessee Eastman Process143.3. SUMMARYWhether the attack remains stealthy or causes a shutdown, it is necessaryto develop methods to detect the attack. Hereafter, the concepts behind themethodology proposed to detect and verify replay attacks in this thesis willbe described based on the framework shown in Fig. 3.3, consisting of twostages. Throughout the whole detection and verification procedure, sensormeasurement data is used without any process knowledge.3.3 SummaryThis chapter describes replay attacks on sensor measurements and theireffect on industrial control systems. It also defines four different scenariosof replay attacks on sensor measurements.153.3. SUMMARYContinuemonitoringReal-TimeSensorMeasurementsComputecorrespondingmatrix profile Perform change-point detectionusing EWMAGeneratefusion timeseries NoStage I - Real-Time Monitoring of Sensor MeasurementsYes Change-pointdetected at No(a) Stage IStage II - Real-Time Verification of Replay AttacksGeneratespectrogram imageframes using STFTTrainedConvLSTM-AEComputereconstructionerrorNormaloperationNoYesReplayattack atframeTrain ConvLSTM-AEand determinethreshold Historical Normal SensorMeasurementsGeneratecorrespondingmatrix profile Generate spectrogram image frames usingSTFT(b) Stage IIFigure 3.3: The two stages of the proposed replay attack detection andverification framework16Chapter 4Stage I - Real-TimeMonitoring of SensorMeasurementsSensor measurements are continuously produced to represent the con-trolled process’s current condition. In order to gain insights into the be-haviour of the process, real-time monitoring is required, which entails gath-ering, processing, and analysing these sensor measurements as they are gen-erated. Since replay attacks demonstrate a change in the trend of the timeseries sensor measurements, continuous monitoring for such changes helpsindicate the possibility of a replay attack occurrence.4.1 Matrix ProfileThe most effective monitoring for replay attacks in time series sensordata is based on sequence patterns. Referring to the formulation of replayattacks in Chapter 3, looking for similar subsequences in the time series datacan be a good indication of a replay attack. To perform this monitoring,the matrix profile technique proposed in [36] is utilised. It is a powerfulapproach for detecting similar subsequences within a time series, based ona distance profile such as Euclidean distance. In comparison with othertechniques such as dynamic time warping (DTW) and Smith-Watermanalgorithms, matrix profile provides a holistic analysis of patterns in timeseries data by performing tasks that identify similar and anomalous patterns[37], rather than performing sequence alignment and similarity measurementbetween two sequences. It is also more computationally efficient than DTWand Smith-Waterman algorithms, especially with larger time series data.Based on the matrix profile implementation proposed in [38], an incrementalcomputation of the matrix profile is achieved with time complexity of O(1).Considering sensor measurements y(t) are received in real-time, a querysubsequence is defined at time t = j using (3.1), where I = [j, j+k] and k is174.1. MATRIX PROFILEthe subsequence length for which the comparison is performed. The choiceof length k influences the degree of similarity of the subsequences. Conse-quently, for a given query subsequence at time j denoted as Y j , the distanceprofile is calculated by sliding Y j along the time series and computing thedistances between the query subsequence and all possible subsequences. Theresulting distance profile Dj is represented as follows:Dj =[dj1, dj2, . . . , djh](4.1)where j ∈ {1, 2, . . . , h}, h = NY − k + 1, and NY represents the currentlength of the time series data. An entry dji is the z-normalized Euclideandistance computed as follows:dji =√√√√ k∑t=1((yj(t)− µjσj)−(yi(t)− µiσi))2(4.2)where i ∈ {1, 2, . . . , h} is a possible subsequence in the current time series,yj(t) and yi(t) denote a single data point at time t of subsequences j and i,respectively. µj , µi, σj and σi denote the mean and variance of subsequencesj and i, respectively. Computing the distance profiles for all possible subse-quences j in time series data of length NY , a distance matrix D ∈ Rh×h isconstructed as follows:D =D1...Dh (4.3)where each row of the distance matrix represents a distance profile for aquery subsequence as defined in (4.1). The matrix profile is then computedby storing the smallest non-trivial distance (i.e., distances greater than zero)from each distance profile. The matrix profile M is defined as a time seriesrepresented as follows:M = {mj(t), t ∈ I} (4.4)where interval I = [0, NY −1]. Each elementmj(t) = min(Dj), where min(·)describes the minimum z-normalized Euclidean distance. Generally, lowmatrix profile values indicate a repeated pattern, while high values indicate anew pattern [39]. Therefore, when a change occurs in the time series matrixprofile M (i.e., the matrix profile values drop or increase), it indicates achange in the pattern of the original time series sensor measurement. Tomonitor such changes, change-point detection is implemented.184.2. CHANGE-POINT DETECTION4.2 Change-point DetectionStatistical analysis is a prominent approach for monitoring time seriessensor measurements. Change-point detection is a technique that utilisesstatistical analysis to identify points in time series data where a significantchange or shift occurs in the underlying statistical properties. It is effectivein detecting deviations from expected patterns and indicates potential eventsor anomalies in the data. Change-point detection algorithms analyse thetime series data, examining changes in statistical characteristics such asmean, variance, distribution, or other parameters. These algorithms aim topinpoint the exact moments when the behaviour of the characteristics shiftssignificantly, indicating a change in the underlying process being monitored.For the scope of this work, three algorithms have been developed for onlinechange-point detection in time series sensor measurements.4.2.1 Bayesian Online Change-Point DetectionBayesian Online Change-Point Detection (BOCPD), first proposed in[40] leverages the principles of Bayesian inference to estimate change-pointsin the sensor measurements. It involves formulating prior information aboutthe sensor measurement distribution and change-points. In this thesis, his-torical sensor measurements are utilised to initialise the prior distributionand likelihood function. By incorporating prior information, the Bayesianapproach allows for more accurate and reliable change-point detection. Thehistorical normal sensor measurements are defined following (3.1) and de-noted as Y 0. Based on the central limit theorem, which states that thesample mean of a large number of independent and identically distributedrandom variables tends to be approximately normally distributed, a Gaus-sian likelihood function is assumed. Accordingly, assuming that the genera-tive parameters before and after the change-points are different, this resultsin a prior distribution of normal-gamma based on Bayesian rule. Based onthis, two sets of parameters are defined, namely the posterior parametersϕ = {µ, σ2, ν, β} and prior parameters θ = {µ0, σ20, ν0, β0}. To initialise theprior parameters for the change-point detection model, the historical mea-surements Y 0 are used. The prior mean µ0 and variance σ20 are set as thesample mean y¯0 and variance s20 of Y0, respectively. The prior shape ν0 andrate β0 are initialised as follows:ν0 =y¯02s20(4.5)194.2. CHANGE-POINT DETECTIONβ0 =y¯0s20(4.6)To this end, the change-point detection model receives sensor measurementsy(t) in real-time. BOCPD works by modeling the time since the last change-point, called the run length denoted by rt. rt at time t can take the followingvalues:rt ={0 if change-point at trt−1 + 1 otherwise(4.7)indicating the run length either continues to grow or becomes 0 when achange-point occurs. As a result, the change-point prior denoted as p(rt|rt−1)is modeled asp(rt|rt−1) =H(rt−1 + 1) if rt = 01−H(rt−1 + 1) if rt = rt−1 + 10 otherwise(4.8)where H(·) is a hazard function indicating the probability of a change-point. The change-point prior allows incorporating prior knowledge aboutthe data’s change-points into the model. It follows the assumption that rtis conditionally independent of everything else given rt−1. The predictiveprobability for each run length is performed by marginalising the run lengthrt (i.e., doing so for every possible rt parameter value). Accordingly, at eachtime t, BOCPD models (t + 1) hypotheses for rt. Therefore, at each timet, (t+ 1) posterior predictive parameters must be recorded. The predictiveprobability denoted by π(r)t is defined asπ(r)t = p(y(t+ 1)|y(t)) =∑rtp(y(t+ 1)|rt, θ)p(rt|θ, y(t+ 1)) (4.9)where p(y(t+ 1)|rt, θ) is the likelihood of observing data point at y(t + 1)given a change-point and p(rt|θ, y(t+ 1)) is the posterior distribution whichis obtained using variational inference. Variational inference approximatesthe posterior distribution p(rt|θ, y(t+ 1)) by finding the optimal variationalparameters that minimize the Kullback-Leibler divergence between the trueposterior and an approximate distribution, called the variational distribu-tion. The objective function for variational inference is defined using thenegative evidence lower bound as follows:L = Eq[log(p(y(t+ 1), rt|θ)p(θ)q(θ))](4.10)204.2. CHANGE-POINT DETECTIONwhere p(y(t+ 1), rt|θ) is the joint distribution of the observed data andchange-points given the prior parameters θ, p(θ) is the prior distributionand q(θ) is the variational distribution. Eq[·] denotes the expectation. Theoptimal variational parameters determined are used to define the posteriordistribution p(rt|θ, y(t+ 1)), which is used to compute the posterior parame-ters denoted as ϕ. The posterior of run length given the sensor measurementsobserved so far, which are defined as time series Y using (3.1), is computedas follows:p(rt|Y ) = p(Y, rt)p(Y )(4.11)where p(Y, rt) is a joint probability function and p(Y ) is the evidence ormarginal likelihood, which acts as a normalisation constant to ensure thatthe posterior distribution is a valid probability distribution. Finally, theprobability of a change-point denoted as p(rt = 0|y(t)) is computed as fol-lows:p(rt = 0|Y ) =∑rt−1p(rt, Y )π(r)t H(rt−1) (4.12)The change-point is detected when the posterior of zero run length is higherthan the posterior of growth run length.Given the described steps of BOCPD, change-point detection based onBayesian inference is described in Algorithm 1 below.Algorithm 1 Bayesian Online Change-point DetectionInput: Sensor measurements y(t) in real-timeOutput: Change-point at tc,1: Determine likelihood function and initialise prior hyperparameters θ2: while t > 0 do3: Determine H(·)4: y(t): Current data point5: Obtain predictive probability in (4.9) for each run length using (4.10)6: Calculate posterior run length using (4.11)7: Calculate probability of a change-point based using (4.12)8: if p(rt = 0|Y ) > p(rt = rt−1 + 1|Y ) then9: Change-point at tc detected10: else11: Repeat lines 4-812: end if13: end while214.2. CHANGE-POINT DETECTION4.2.2 Change-Point Detection using Statistical ProcessControlStatistical process control (SPC) is used to monitor, control, and improveprocesses by employing statistical techniques. It entails the application ofstatistical methods, such as control charts, to analyse process data, detectpatterns and identify variations or abnormalities in order to maintain thestability and quality of a process. Control charts are a graphical represen-tation of how a process changes over time based on predetermined controllimits. The control limits are based on statistical calculations and representthe expected variation in the process under normal conditions. By com-paring the observed measurements to the control limits, SPC enables thedetection of process changes, including change-points. In this thesis, twostatistical process control charts are utilised for change-point detection.Cumulative SumGiven time series sensor measurements Y , Cumulative Sum (CUSUM)performs change-point detection based on the calculation of the cumulativesum of a sequence of sensor measurements y(t). Assuming sensor mea-surements y(t) are received in real-time, the average denoted as y¯ of theaccumulated measurements is calculated asy¯ =1NYNY∑i=0y(i) (4.13)Then, the deviation ∆ is computed for each y(t) received as∆ = y(t)− y¯ (4.14)The cumulative sum S is updated asS = max(0, S +∆− d) (4.15)where max(·) denotes the maximum and d represents the drift parameter.It helps control the effect of cumulative sum and influences the sensitivityof the algorithm to detect change points [41]. A higher drift value reducesthe effect of cumulative sum, making the algorithm less sensitive to smallfluctuations in the data. While, a lower drift value makes the algorithmmore sensitive to smaller changes in the data, including gradual drifts orsmaller fluctuations.224.2. CHANGE-POINT DETECTIONFinally, a change-point is detected by comparing the cumulative sum Sto a predefined threshold τcs.Given the described steps of CUSUM, change-point detection using CUSUMis described in Algorithm 2 below.Algorithm 2 Cumulative Sum Change-point DetectionInput: Sensor measurements y(t) in real-timeOutput: Change-point at tc,1: Set drift d and threshold τcs2: while t > 0 do3: y(t): Current data point4: Update y¯ using (4.13)5: Compute ∆ using (4.14)6: Update S using (4.15)7: if S > τcs then8: Change-point at tc detected9: else10: Repeat lines 4-711: end if12: end whileExponentially Weighted Moving AverageExponentially Weighted Moving Average (EWMA) is a statistical methodcommonly used for change-point detection in time series data. It is a vari-ation of the moving average method that assigns exponentially decreasingweights to past observations, giving more importance to recent data points.EWMA is particularly useful for identifying immediate changes or shifts inthe time series measurements [42]. The key advantage of EWMA for change-point detection is its responsiveness to recent changes. As the weights de-crease exponentially over time, the algorithm adapts quickly to new patternsin the data. This makes EWMA effective at detecting immediate changesand suitable for real-time applications where prompt change-point detectionis crucial.Given time series sensor measurements Y , EWMA for a sensor measure-ment y(t) received in real-time is defined as follows:Ej(t) = αy(t) + (1− α)Ej(t− 1) (4.16)where Ej(t) denotes the EWMA at time t and α represents the smoothing234.3. MATRIX PROFILE CHANGE-POINT DETECTIONfactor, which controls the rate of decay for the weights. A smaller valueof α assigns more weight to recent observations, making the EWMA moreresponsive to changes.The change-point is determined by comparing the EWMA with the cur-rent sensor measurement y(t). If the difference exceeds a predefined thresh-old τc, it indicates a change-point in the time series data. The choice ofthe threshold depends on the desired sensitivity to changes and the level offalse alarms that can be tolerated. EWMA is a flexible and computationallyefficient method for change-point detection, providing valuable insights intoshifts and patterns in time series sensor measurements.Given the described steps of EWMA, change-point detection using EWMAis described in Algorithm 3 below.Algorithm 3 Exponentially Weighted Moving Average Change-point De-tectionInput: Sensor measurements y(t) in real-timeOutput: Change-point at tc,1: Initialise Ej(t) as y(0)2: Set smoothing factor α and threshold τc3: while t > 0 do4: y(t): Current data point5: Update Ej(t) using (4.16)6: if |Ej(t)− y(t)| > τc then7: Change-point at tc detected8: else9: Repeat lines 4-610: end if11: end while4.3 Matrix Profile Change-point DetectionSeveral change-point detection approaches proposed in the literature areeffective, however, for real-time monitoring, it is important to use an efficientand fast method. For comparison, BOCPD and CUSUM are considered.In comparison with EWMA, BOCPD is more computationally demanding,where the computation time per data point is 22 ms. This is significantlyhigher compared to EWMA where the computation time per data point is0.0167 ms. In addition, BOCPD requires more parameters and calculations244.3. MATRIX PROFILE CHANGE-POINT DETECTIONthan EWMA and CUSUM. This can be impractical in the case of replayattack detection, where real-time results are crucial. Change-point detectionusing CUSUM is computationally similar to EWMA. However, EWMA onlyrequires the current moving average and the most recent data point, makingit computationally less intensive and requiring less memory compared toCUSUM, which often requires storing a cumulative sum of historical data.Therefore, EWMA is utilised for change-point detection. Considering thetime series matrix profile M, EWMA is redefined as follows:Ej(t) = αmj(t) + (1− α)Ej(t− 1) (4.17)The change-point is determined by monitoring the difference between thecurrent matrix profile elementmj(t) and the computed Ej(t). This differenceis defined as the deviation δ as follows:δ = |mj(t)− Ej(t)| (4.18)where | · | represents the absolute value. Accordingly, the change-point attime tc is determined by comparing the deviation δ against a predefinedthreshold τc. The threshold τc should be selected to minimise the missedalarm rate (i.e., missed detection of change-points due to replay attacks),while also maintaining a low false alarm rate (i.e., change-points that arenot due to replay attacks). In practice, the real-time monitoring startsat t = k + 1 by considering subsequences of length k and computing thematrix profile. Subsequently, change-point detection is performed on thecorresponding matrix profile values. Although computational resources arerequired (i.e., memory resources for storing historical data) as the lengthof the time series increases, the monitoring using EWMA is based on basicarithmetic operations (e.g., addition and multiplication), making it compu-tationally simple. As a result, this stage provides low detection delays forreal-time monitoring, while being less computationally demanding.Although change-point detection of the time series matrix profile cansuccessfully indicate the occurrence of a replay attack, it is also sensitiveto other events that cause a change in sensor measurements pattern (e.g.,change in operational settings or random faults). Consequently, the secondstage of the detection framework is proposed to confirm whether a change-point is due to a replay attack or not. For the second stage of the detectionframework, a fusion time series data is defined asYM = Y ◦M = {yM(t), t ∈ I} (4.19)where ◦ denotes the Hadamard product and yM(t) is an element of the fusiontime series data YM. The purpose of the newly defined fusion time series254.3. MATRIX PROFILE CHANGE-POINT DETECTION2797.52800.02802.5Time, t01013.5 14.0 14.5 15.0 15.5 16.0Time, t025000Time seriesMatrix ProfileFusion Time SeriesFigure 4.1: The time series data, corresponding matrix profile, and fusiontime series of reactor pressure sensor measurementsdata is to incorporate the properties of the computed matrix profile for thesensor measurements, highlighting the occurrences of repeated patterns ofinterest. Fig. 4.1 shows reactor pressure time series data, from the TennesseeEastman process with a delay replay attack (i.e., Scenario 1 in Chapter 3)for an interval Iattack = [15, 16], along with the corresponding matrix profileand fusion time series. It can be observed that the matrix profile values dropsignificantly for the duration of the replay attack. This creates a change-point through which a replay attack is then verified. The importance ofusing the fusion time series rather than the original time series data can bevalidated based on the plot, where the delay replay attack in the fusion timeseries can be clearly observed. It can be seen that the fusion time seriesprovides amplified values for the normal data instances, as opposed to thereplay attack instances (values close to zero). This amplification can helpemphasize regions in the time series where patterns are more noticeable.Remark: By conducting change-point detection on the matrix profilederived from sensor measurements, as opposed to directly analysing themeasurements themselves, the monitoring process can be more effectivelytargeted at identifying changes in the time series pattern, rather than any264.4. SUMMARYAlgorithm 4 Real-time Monitoring of Sensor Measurements using MatrixProfile Change-point DetectionInput: Sensor measurements y(t) in real-timeOutput: Change-point time tc, fusion time series data YM1: Determine subsequence length k for matrix profile, and α and τc forchange-point detection2: Initialise Ej(t) using first sensor measurement3: for k + 1 ≤ t ≤ NY − 1 do4: for 1 ≤ j ≤ h do5: Compute distance profile Dj for query subsequence Y j using (4.1)and (4.2)6: Determine the corresponding matrix profile entry mj(t) of (4.4)7: Update Ej(t) using (4.17)8: Calculate δ using (4.18)9: if δ ≥ τc then10: Change-point detected at tc11: Generate new fusion time series data using (4.19)12: else13: Continue monitoring14: end if15: end for16: end forfluctuations that could be irrelevant (e.g., due to noise). As a result, falsealarms are reduced. More importantly, analysing the matrix profile expandsthe detection capabilities to cover all the different replay attack scenarios,in particular the delay replay attack in Scenario 1, which is not possible todetect otherwise.Given the described steps of change-point detection of the time seriesmatrix profile, the real-time monitoring stage of the proposed framework issummarised in Algorithm 4.4.4 SummaryThis chapter describes the first stage of the proposed detection and veri-fication framework. The first stage consists of continuous real-time monitor-ing of the sensor measurements for similar subsequences. This monitoringis performed based on the computation of the matrix profile. Subsequently,274.4. SUMMARYchange-point detection using EWMA is performed on the matrix profile.The change-point would indicate a change in the pattern of the time seriesdata. The purpose of this stage is to perform an early detection of a pos-sible replay attack through the detection of a change-point, as it requiresrelatively a low computational cost.28Chapter 5Stage II - Real-TimeVerification of ReplayAttacksThis chapter describes the second stage of the proposed framework whichverifies whether a change-point is due to a replay attack or not. The secondstage is necessary since the detected change-point can also result from achange in operational settings or random faults. It consists of two phases,namely, spectro-temporal feature extraction and replay attack verificationusing ConvLSTM-AE. As opposed to the previous stage, this stage pro-vides an accurate verification of a replay attack, eliminating false alarmsthat may be generated in the first stage, however, at the expense of highercomputational cost. This is achieved mainly through the distinct features ofreplay attacks represented by spectrogram image frames which are difficultto reconstruct using a ConvLSTM-AE trained on normal/nominal time se-ries data. The ability to uncover hidden patterns, temporal variations, andfrequency content associated with the attack through spectrogram imageframes increases the reliability of the attack verification.5.1 Phase I: Spectro-Temporal FeatureExtractionDuring a replay attack, the injected recorded measurements present dis-tinct patterns that result in the change of the matrix profile. This changeis reflected by the significantly low/high values of the matrix profile. Whenthese values are combined with the original time series data, distinct pat-terns are generated (e.g., the periodicity nature of Scenario 2 of the replayattack). It is difficult to interpret the resulting patterns and their implica-tions for replay attacks using the newly defined fusion time series data asthey may be masked by factors such as noise. However, analysing the fre-quency domain properties proves to be effective in overcoming this challenge.295.1. PHASE I: SPECTRO-TEMPORAL FEATURE EXTRACTIONThis is commonly performed using classical Fourier transform [43]. However,this method assumes the studied signal as stationary, providing frequencyinformation averaged over the entire signal time interval [44]. Accordingly,time-frequency analysis methods are utilised. The distinct differences be-tween normal and replay attack time series data are easier to measure andquantify through time-frequency analysis. The use of time-frequency infor-mation of time series data in deep learning-based frameworks with the aim ofanomaly detection (e.g., attacks and faults) has been studied in some papers.For example, [45] focused on fault diagnosis in which a logarithmic functionwas utilised with short-time Fourier transform with the purpose of enlarg-ing the details of the characteristics and easing the classification. In [46],fault diagnosis in induction motors was done by analysing the spectogramsgenerated using short-time Fourier transform, and combining wavelet andpower-spectral-density techniques. In [47], wavelet transform and deep neu-ral network techniques were used for detecting false data injection attacks.In this thesis, short-time Fourier transform is performed to the fusion timeseries data to generate spectro-temporal features in the form of spectro-grams.5.1.1 Short-Time Fourier TransformThe short-time Fourier transform is one of the most popular techniquesfor time-frequency analysis. Fig. 5.1 shows a schematic of the spectro-temporal feature extraction using short-time Fourier transform. As shown,the method utilises a window function to extract time domain information[48]. The window function splits the time series data into segments and isshifted over each segment with some overlapping to calculate the frequencycontent using the fast Fourier transform (FFT). In contrast to the classicalFourier transform, short-time Fourier transform portrays the frequency con-tent in a temporal manner. During short-time Fourier transform, the fusiontime series data YM, defined using (4.19), is split into M segments througha window of length L and overlap O. Then, an F point FFT is performedon each segment. M and F are defined asM =⌊NM − LL−O⌋+ 1 (5.1)F =L2+ 1 (5.2)where ⌊·⌋ denotes the floor operator andNM represents the number of pointsin time series data YM. A series of FFT results are obtained and arranged305.1. PHASE I: SPECTRO-TEMPORAL FEATURE EXTRACTIONSpectrogram Image FramesSliding windowof lengthTimeFrequency...Fusion TimeSeries Data WindowingStacking FFTresults asSpectrogramFFTFFTFFTWindow LengthOverlapTimeFigure 5.1: Spectro-temporal feature extraction schematicto get a 2D short-time Fourier transform matrix representation X ∈ RF×Mas follows:X =X(0, 0) . . . X(0,M)... . . . ...X(F, 0) . . . X(F,M) (5.3)Each entry denoted as X(f,m) is computed using the short-time Fouriertransform operation as follows:S{yM(t)} = X(f,m) =∞∑t=−∞yM(t)w(t−m)e−j2πftL (5.4)where m ∈ {0, . . . ,M} and f ∈ {0, . . . , F} represent the time and frequencyinstances, respectively, and w(t) represents the window function. The choiceof window function can affect the time-frequency analysis [49]. Among theavailable window functions, the Hann Window is chosen as shown in Fig. 5.1.The Hann Window provides satisfactory results in terms of frequency res-olution and spectral leakage for most input signals (i.e., time series data)[50]. It is known as a cosine taper, which starts at 0, smoothly rises to 1 inthe middle of the period, and then smoothly goes back down to zero at theend. The Hann window function is defined as follows:w(t) =12(1− cos 2πtNM − 1)(5.5)315.1. PHASE I: SPECTRO-TEMPORAL FEATURE EXTRACTIONTo ensure accurate frequency representation, the window length L has toprovide sufficient frequency components to spread over frequencies up to theNyquist frequency of fs/2, fs being the sampling frequency. In addition, itis important to assume the stationarity of the signal within the window forFFT. This is possible through an appropriate size of window overlap O. Anon-zero overlap allows the detection of changes between adjacent segments.However, it requires increased computation time. Since the temporal natureis essential for replay attack detection, a large overlap is chosen to achievehigh time resolution.5.1.2 Spectrogram Image Frame GenerationThe short-time Fourier transform matrix result X is visualised as a spec-trogram, which is an intensity plot of short-time Fourier transform magni-tude over time. This visualisation makes it easier to observe frequency pat-terns related to replay attacks. To fully extract the frequency features overtime, the spectrogram is split into several chunks called frames. Given aspectrogram X, it is divided, along the time axis, into several spectrogramseach of length Z, determined based on the sampling frequency fs as follows:Z = λfs (5.6)where λ is a scaling factor that determines the number of sample data pointsprocessed in real-time. Now, the data can be represented as X(i) ∈ RF×Z ,where i ∈ {0, . . . , MZ − 1} is the number of frames. The spectrogram framesare converted to image frames of size w′×h′×c, where w′ and h′ represent thewidth and height of the image, respectively, and c represents the number ofchannels in the image. The conversion to image frames allows the verificationof replay attacks based on the patterns retained in each image frame. Thespectrogram image frames are resized to form an image of size η × η × c,where η depends on the length Z of the spectrogram image frames. Toensure low computational complexity, the image size η should be selectedas the minimum size that produces visible spectrogram features. A pixelp with coordinates (x, y) in the resized image P (px, py) has the followingcoordinates in the input image:px(w′) =⌊x(w′η)⌉(5.7)py(h′) =⌊y(h′η)⌉(5.8)325.2. PHASE II: VERIFICATION OF REPLAY ATTACK USING CONVLSTM-AEwhere ⌊·⌉ denotes rounding to the nearest integer. The resized image P (px, py)is formed as follows:P (px, py) =(p0, p0) . . . (p0, pη)... . . . ...(pη, p0) . . . (pη, pη) (5.9)where (px, py) represent the pixel values of the image P (px, py). Each pixelvalue (px, py) is normalised to range from 0 to 1. This is performed to reducecomputational complexity by having all the input image frames on the samescale. The image P (px, py) is normalised as follows:P (px, py) =P (px, py)−min(P (px, py))max(P (px, py))−min(P (px, py)) × 255 (5.10)where min(·) and max(·) describe the minimum and maximum values, re-spectively.Given the described steps for generating spectrogram image frames usingshort-time Fourier transform, the spectro-temporal feature extraction phaseof the proposed framework is summarised in Algorithm 5.Algorithm 5 Spectro-Temporal Feature ExtractionInput: Fusion time series data YM from Algorithm 4Output: Image frames of size η × η × c1: Obtain sampling frequency fs and number of samples NM, and definewindow length L and overlap O for STFT2: for 0 ≤ n ≤ NM do3: Generate spectrogram X based on (5.3)-(5.5)4: end for5: Define scaling factor λ and image size η6: Calculate frame length Z using (5.6)7: for 0 ≤ i ≤ MZ − 1 do8: Split X spectrogram into X(i) frames9: Build the resized image P (px, py) for frame i using (5.7)-(5.10)10: end for5.2 Phase II: Verification of Replay Attack usingConvLSTM-AEBased on the spectro-temporal feature extraction performed followingAlgorithm 2, the fusion time series data is in the form of image frames,335.2. PHASE II: VERIFICATION OF REPLAY ATTACK USING CONVLSTM-AECell StateForget Gate Input Gate Output GateFC Layer withactivation functionPointwise additionPointwise multiplicationFigure 5.2: LSTM cell structure showing the input, output, and forget gateseach of size η × η × c. First, the model is trained offline, utilising convolu-tional LSTM layers to learn the spectro-temporal features of the data. Themodel is trained using spectrogram image frames X(i) of normal/nominalsensor measurements (i.e., attack-free), which are split into training andvalidation datasets. The ConvLSTM layers are arranged in an autoencoderarchitecture. Using the trained ConvLSTM-AE, the replay attack is de-tected/verified based on the reconstruction error. Using spectrogram imageframes rather than time series data provides robust replay attack verificationwhile being computationally efficient.5.2.1 Long Short-Term Memory Neural NetworksRecurrent neural networks (RNNs) are feedforward networks that effec-tively capture the dynamic temporal behavior of sequential data by em-ploying hidden states to process the input sequences [51]. RNNs containfeedback loops that make them capable of handling tasks based on the tem-poral sequence (i.e., time series data). Long Short-Term Memory (LSTM)neural network [52], a common type of RNN, was proposed by researchersto overcome the issue of the vanishing gradient which occurs in traditionalRNN when the gradients of the weights in the network become very smalland the network has difficulty learning [53]. In LSTM, a memory cell is in-troduced in addition to the hidden state which acts as an accumulator of thestate information using gates. As shown in Fig. 5.2, LSTM neural networksconsist of input, output, and forget gates that can selectively retain or dis-card information from the memory cell. The gates in an LSTM network canbe controlled by sigmoid activation functions, which output values between0 and 1.345.2. PHASE II: VERIFICATION OF REPLAY ATTACK USING CONVLSTM-AE5.2.2 Convolutional Long Short-Term Memory NeuralNetworksThe main drawback of LSTM when working with spectro-temporal datais the use of full connectivity in input-to-state transitions and state-to-statetransitions with no spatial information encoded. ConvLSTM was introducedin [54] to overcome this problem. It builds better spatial feature maps withfewer weights while applied to the input-to-state and state-to-state tran-sitions. It models the spatio-temporal correlations using its convolutionallayers. Since convolution operations require fewer parameters than linear op-erations, ConvLSTM helps reduce the size of the model. Similar to LSTM,ConvLSTM consists of a set of gates that control the flow of informationinto and out of the memory cell. The memory cell state update computesthe new cell state based on the forget gate, input gate, current input, andthe previous cell state. The input gate controls the weight of the new mem-ory to incorporate into the memory cell. The forget gate determines howmuch of the previous cell state should be forgotten or discarded, while theoutput gate determines how much of the current cell state should be keptas the output. The cell state update multiplies the forget gate with theprevious cell state to discard irrelevant information and adds the input gatemultiplied by the current input to incorporate new information. The keyequations of ConvLSTM are shown as follows:it = σ(Wxi ∗Xt +Whi ∗Ht−1 +Wci ◦ Ct−1 + bi)ft = σ(Wxf ∗Xt +Whf ∗Ht−1 +Wcf ◦ Ct−1 + bf )Ct = ft ◦ Ct−1 + it ◦ tanh (Wxc ∗Xt +Whc ∗Ht−1 + bc)ot = σ(Wxo ∗Xt +Who ∗Ht−1 +Wco ◦ Ct + bo)Ht = ot ◦ tanh (Ct)(5.11)where * denotes the convolution operator. The input, forget, and outputgates are denoted by it, ft, and ot, respectively. Xt, Ht, and Ct represent thenetwork input, hidden state, and cell state at time t, respectively. The inputXt is the η × η × c spectrogram image. Wxi, Whi, Wci, Wxf , Whf , Wcf ,Wxc, Whc, Wxo, Who, and Wco represent the corresponding trainable weightmatrices, and bi, bf , bc, and bo are the bias vectors. tanh (·) and σ(·) are theHyperbolic Tangent and Sigmoid activation functions used, respectively.5.2.3 AutoencodersDue to the rare occurrence of cyberattacks in an industrial application,acquiring large amounts of operational data with attacks may not be possi-355.2. PHASE II: VERIFICATION OF REPLAY ATTACK USING CONVLSTM-AETrained ConvLSTM AutoencoderConv2D LayersConvLSTM2DLayersConv2D LayersSpatialEncoderLatentRepresentation Temporal AttentionSpectrogram Image Framesfor Testing Replay attack NormalReconstructedOutputSpatialDecoderTemporal Encoders-DecodersSpatial AttentionFigure 5.3: Replay attack verification using ConvLSTM-AEble. Therefore, unsupervised methods are utilised, specifically, autoencoders(AE) are implemented with ConvLSTM layers. Unsupervised methods alsoenable the generalisation of the proposed framework to detect a wide rangeof unseen attacks. An AE is used to learn regularity in spectrogram imageframes of normal time series data. An AE is a feedforward neural networktrained to reconstruct its input (i.e., spectrogram image frames) at the out-put layer. A key feature of AEs is that they can be trained using only normaldata. In practice, AEs consist of an encoder that is responsible for featurelearning and latent representation, and a decoder that reconstructs the spec-trogram image frames based on the latent representation. Fundamentally,input spectrogram image frames are projected to a lower dimensional layerthat filters out the noise and better represents the process status, similarto the steady-state estimation in traditional frameworks. Similar to thework in [55] using AEs for anomaly detection in videos, the notion thatthe trained AE will reconstruct regular spectrogram image frames with lowerror, but will not accurately reconstruct spectrogram image frames withreplay attacks is followed.5.2.4 Proposed ConvLSTM-AE ModelFig. 5.3 shows the proposed ConvLSTM-AE model architecture for re-play attack verification.Part 1: Offline ConvLSTM-AE Model TrainingThe ConvLSTM-AE model proposed consists of two types of encoders/decoders; spatial and temporal. A spatial encoder learns the spatial struc-ture (i.e., spectral features) of each spectrogram image frame, and a tem-poral encoder learns the temporal pattern of the encoded spatial structurebetween image frames. The spatial encoder comprises two 2D convolutional365.2. PHASE II: VERIFICATION OF REPLAY ATTACK USING CONVLSTM-AElayers, followed by the temporal encoder-decoder consisting of five 2D Con-vLSTM layers. Finally, a spatial decoder of two convolutional layers decodesthe encoded spatial structure to reconstruct the input. Spatial encodersprocess one input frame at a time to encode spatial structure. Then, atemporal sliding window is used for the spatio-temporal encoder-decoder.Dealing with spectrogram image frames, features may not be as visuallyprominent as those in normal images. To capture these subtle features ef-fectively, two types of attention mechanisms are introduced that enhance themodel’s ability to learn relevant representations. In general, attention canbe viewed as a rule for allocating the processing resources that are availableto the most informative features. It is typically used in conjunction with agating function (e.g., sigmoid) to rescale the feature maps. In this thesis,spatial attention is incorporated to selectively attend to specific frequencybins or spatial locations within each frame. In addition, spatio-temporal at-tention is implemented to dynamically capture long-term dependencies andvariations in the spectrogram over time.When multiple frames are processed, a feature vector is generated byconcatenating the encoded features of multiple frames. This feature vector isthen used by the temporal encoder to encode the temporal pattern. Finally,spectrogram image frames are reconstructed using spatio-temporal decoders.The objective is to train the model such that the reconstruction loss, definedas the mean squared error (MSE), is minimized for a given normal sensormeasurement dataset. This is defined as follows:argminΨw∑X(i)∥X(i) −Ψw(X(i))∥2 (5.12)where X(i) is a spectrogram image frame of the training data and ∥·∥2 de-notes the ℓ2 norm. Ψw represents the weights of the learned latent rep-resentation from the training phase. The MSE loss is used to update themodel weights during training, using the backpropagation through time al-gorithm. The algorithm calculates the gradient of the loss function withrespect to the model weights at each time step and updates the weights tominimize the loss function. Once the model is trained, a threshold value τais defined offline for replay attack verification. This value is normally deter-mined based on the reconstruction error of the training data. However, thethreshold value τa is chosen by running the trained model on a validationdataset. This is performed to ensure the model training is performed welland to avoid over-fitting.375.3. SUMMARYPart 2: Replay Attack VerificationThe replay attack verification is performed using the learned weights Ψwobtained during training and the threshold τa. Following the work in [55],the replay attack is verified based on a regularity score that is computedusing the reconstruction error. The reconstruction error is calculated in twosteps. First, the reconstruction error of a pixel’s intensity value Γ at thelocation (px, py) in frame i of the spectrogram is computed as follows:e(x, y, i) = ∥Γ(x, y, i)−Ψw(Γ(x, y, i)∥2 (5.13)The reconstruction error of a frame i is computed by summing up all thepixel-wise errors:e(i) =∑(x,y)e(x, y, i) (5.14)Then, the attack score Sa(i) is defined as a metric to indicate the occurrenceof a replay attack. The attack score is defined by scaling the reconstructionerror as follows:Sa(i) =e(i)−min(e(i))max(e(i))(5.15)Subsequently, the regularity score Sr(i) is computed using the attack scoreas follow:Sr(i) = 1− Sa(i) (5.16)The purpose of the regularity score is to have a metric that measures hownormal the data is deemed. A replay attack is verified if the regularityscore Sr(i) is below the threshold value τa. Otherwise, normal operation isconcluded. In this thesis, τa is chosen as the minimum regularity score valueof the validation dataset.Given the described steps of replay attack verification using ConvLSTM-AE, the steps of this part of the proposed framework are summarised inAlgorithm 6.5.3 SummaryThis chapter provides a detailed description of the second stage of theproposed framework. The purpose of this stage is to verify whether achange-point is due to a replay attack or not. It consists of two phases,namely, spectro-temporal feature extraction and replay attack verification385.3. SUMMARYAlgorithm 6 Verification of Replay Attacks using ConvLSTM-AEInput: Images frames generated by Algorithm 5 using fusion time seriesdata YMOutput: Attack verification based on Sr(i)1: Part 1: Offline ConvLSTM-AE Model Training2: Split data into training and validation data (e.g., 80% and 20%, respec-tively)3: Train ConvLSTM-AE using training data4: for 0 ≤ i ≤ MZ − 1 do5: Calculate the regularity score Sr(i) of validation data using the learnedweights Ψw with (5.13)-(5.16)6: end for7: Determine the threshold τa as minimum Sr(i) of validation data8: Part 2: Replay Attack Verification9: Obtain learned representation Ψw of trained ConvLSTM-AE, thresholdτa10: Use trained ConvLSTM-AE with real-time data11: for 0 ≤ i ≤ MZ − 1 do12: Calculate the regularity score Sr(i) of test data using learned weightsΨw following (5.13)-(5.16)13: if Sr(i) ≤ τa then14: Replay attack detected15: else16: Normal operation17: end if18: end forusing ConvLSTM-AE. The first phase produces spectrogram image framesthat entail spectro-temporal features which are used in the second phase forthe verification of the replay attacks based on the ConvLSTM-AE recon-struction error.39Chapter 6Performance Evaluation of aCase StudyTo evaluate the effectiveness of the proposed replay attack detectionand verification framework, the Tennessee Eastman process [56] is used,which models the behavior of a real-world chemical process under a rangeof operating conditions. This allows the generation of rich and realisticdatasets. The process generates data that is high-dimensional, nonlinear,and time-varying, like that of many industrial processes. It consists of 41types of measurements, such as those from temperature, pressure, and levelsensors.6.1 Dataset GenerationTo simulate replay attacks, the cyberattack simulation proposed in [57]and implemented in Matlab/Simulink and .NET code is utilised. This sim-ulation is based on the decentralized closed-loop process model by [58]. Forthe case study, the control loop in charge of controlling the reactor pressureis selected to perform the replay attacks.First, the Tennessee Eastman process simulation is run to generate nor-mal operational data to train the ConvLSTM-AE model (i.e., Part 1 ofAlgorithm 6). For each dataset, the simulation is run for 72 hours witha sampling rate of fs = 2000 samples/hour. Normally, after a simulationis completed, the process data is downsampled to 100 samples/hour be-fore being stored in the Matlab workspace. However, for this case study,the original data is used without downsampling. This is necessary to havehigher-resolution spectrograms for attack verification, providing better per-formance.Then, the Tennessee Eastman process simulation is run for 48 hours usingthe same sampling interval to generate datasets with replay attacks. Usingthe simulation, the replay attack is implemented according to the modeland the four scenarios defined in Chapter 3. The datasets are generated406.2. OFFLINE CONVLSTM-AE MODEL TRAININGwith replay attacks based on different period lengths T , where the recordingstarts at trecord = 3 hours.6.2 Offline ConvLSTM-AE Model TrainingTo train the ConvLSTM-AE model, ten datasets of different normal op-erating conditions are used. The datasets are generated using the randomTennessee Eastman process model that generates different outputs for eachsimulation run. Scenarios of changing operating conditions during the pro-cess (i.e., setpoint changes) are also included. This is performed to ensuremodel generalisation and to prevent over-fitting.Based on the proposed framework in Chapters 4 and 5, the correspondingmatrix profile is first computed for each dataset. Each training datasetconsists of normal reactor pressure sensor measurements defined using (3.1)where I = [0, 72]. Accordingly, the matrix profile is computed following(4.1)-(4.4), for a subsequence length k = 100. Using the matrix profile timeseries, the fusion time series is defined based on (4.19). Then, spectrogramsare generated for each fusion time series data of length NM = 144000 usingAlgorithm 5. For short-time Fourier transform, since the sampling rate isfs = 2000 samples/hour, a window length L = 1024 is chosen which yields513 frequency components that are sufficient to spread over frequencies up tothe Nyquist frequency of fs/2 = 1000 samples/hour. Although this resultsin a low time resolution, a large overlap of O = 1023 is used to enhancethe time resolution. Then, using the Hann window, each signal is splitinto 144001 segments to which a 513-point FFT is applied, following (5.4)-(5.5). Finally, spectrogram images are generated using the X ∈ R513×144001matrices generated for each dataset (e.g., as shown in Fig. 6.1(a)).To prepare the data for training, each spectrogram is split into imageframes of length Z = 1000. This allows the generation of spectrogramsfor every 0.5 hour of the process. The frames are resized using (5.7)-(5.9),where η is chosen as 128. This image size is the minimum size where allspectrogram features are visualised. Using images larger than 128 wouldprovide similar performance at a higher computational cost. The number ofchannels of the spectrogram image frames generated is c = 4. Then, pixelvalues are scaled between 0 and 1 using (5.10). Finally, the frames of all tendatasets are concatenated into one training set.The ConvLSTM-AE model is trained with Adam optimizer, which pro-vides computational efficiency and requires fewer parameters for tuning [59].This provided convergence after 20 epochs with a batch size of 16. The pro-416.2. OFFLINE CONVLSTM-AE MODEL TRAINING(a) Normal Data(b) Replay Attack DataFigure 6.1: Spectrogram generated for normal data and replay attack dataof Scenario 2426.2. OFFLINE CONVLSTM-AE MODEL TRAININGgramming is done using Python version 3.7, on a system with the 11thgeneration Intel core i5-1145G7 processor. Table 6.1 shows the layers typesand outputs of the ConvLSTM-AE model. Following Algorithm 6, the re-construction error is computed using a validation dataset. The validationdataset contains normal sensor measurements that are not used in training.Following (5.13)-(5.16), the regularity score is computed based on the re-construction error. This is performed to be able to determine the thresholdvalue τa. Based on the regularity score of the validation set, τa is chosen asthe minimum regularity score of 0.8.Table 6.1: Types and Outputs of the Layers of the ConvLSTM-AE ModelLayer Type Output SizeInput (128, 128, 4)Conv-2D (64, 64, 64)Layer Normalization (64, 64, 64)Conv-2D (32, 32, 32)Layer Normalization (32, 32, 32)Spatial Attention (32, 32, 32)ConvLSTM-2D (32, 32, 64)Layer Normalization (32, 32, 64)ConvLSTM-2D (32, 32, 32)Layer Normalization (32, 32, 32)ConvLSTM-2D (32, 32, 16)Layer Normalization (32, 32, 16)ConvLSTM-2D (32, 32, 32)Layer Normalization (32, 32, 32)ConvLSTM-2D (32, 32, 64)Layer Normalization (32, 32, 64)Spatio-Temporal Attention (32, 32, 64)Conv-2D (64, 64, 32)Layer Normalization (64, 64, 32)Conv-2D (128, 128, 64)Layer Normalization (128, 128, 64)Output (128, 128, 4)Total Trainable Parameters: 3,544,262436.3. REAL-TIME MONITORING OF SENSOR MEASUREMENTS6.3 Real-Time Monitoring of SensorMeasurementsThe performance of our model is evaluated based on its ability to de-tect and verify replay attacks using (5.13)-(5.16). To evaluate the model,the datasets generated using the Tennessee Eastman process are used basedon different replay attack scenarios. Following the two stages described inChapters 4 and 5, real-time sensor measurement monitoring is first per-formed for each dataset based on Algorithm 4. For a subsequence lengthof k = 100, the monitoring begins after 100 measurements are received(i.e., from the reactor pressure sensor). Subsequently, the matrix profileis updated based on the distance profile for each query subsequence using(4.1)-(4.4). In addition, for each entry of the matrix profile, change-pointdetection is performed with α = 0.2 and τc = 2, which were manually se-lected by considering different values and choosing the ones that provide thebest performance. The monitoring results for each scenario of Chapter 3 aredescribed below:1. Scenario 1: A delay replay attack is performed using a recorded periodof T = 1 hour for an attack interval Iattack = [15, 16]. A change-pointis detected at tc = 15.05 hours, indicating the possibility of a replayattack.2. Scenario 2: For this scenario, the attack is performed using a recordedperiod of T = 0.25 hour for N = 80, resulting in an attack intervalIattack = [15, 35]. A change-point is detected at tc = 15.025 hours,indicating the possibility of a replay attack.3. Scenario 3: A random sample is taken of the recorded period T = 1hour, to obtain random sensor measurements of period T = 0.5 hour.The attack is performed using the random sensor measurements for aninterval Iattack = [15, 35]. In addition, a setpoint change is performedat t = 13 hours. For this case, a change-point is detected at tc =13.3625 hours and later at tc = 15.19 hours, indicating the possibilityof two replay attacks.4. Scenario 4: Fault 1 of the Tennessee Eastman process is activated foran interval I = [15, 16]. In addition, a replay attack is performedusing a recorded period of T = 1 hour for an interval Iattack = [16, 36].Accordingly, the real-time monitoring results in two change-points attc = 15.02 and tc = 16.06 hours, indicating the possibility of two replayattacks.446.4. REPLAY ATTACK VERIFICATIONFor each of the scenarios, the fusion time series data is defined using(4.19), where I = [0, tc + z] and z is chosen such that (tc + z)fs is divisibleby the spectrogram frame length Z to be able to obtain an integer number offrames i. For example, in Scenario 1, z is chosen to be 0.45 for the change-point at tc = 15.05. This choice enables us to generate a sequence of 31spectrogram image frames that accurately depict the fusion time series.6.4 Replay Attack VerificationTo confirm whether a change-point is detected due to a replay attack ornot, the second stage of the proposed framework is implemented. Spectro-grams are generated of the fusion time series data for each of the attack sce-narios implemented. Similar to the training data, short-time Fourier trans-form is used with the same window length L = 1024 and overlap O = 1023.The time series signal YM of length NM is split into M segments to whicha 513-point FFT is applied, forming a X ∈ R513×M spectrogram (e.g., asshown in Fig. 6.1(b)).Figs. 6.1(a) and 6.1(b) show two sample spectrograms of normal andreplay attack data, respectively. Comparing both spectrograms, it can bevisually observed that there are patterns showing high periodicity in thetime interval [15, 35] hours of Fig. 6.1(b), indicating and confirming the oc-currence of a replay attack. This justifies the proposed framework, showingthat the time-frequency analysis on the fusion time series data using short-time Fourier transform provides features that are able to distinguish replayattacks, which is not possible using data in the time domain.The test data is prepared similar to the training data where the spec-trogram images formed for each case are split into image frames of lengthZ = 1000. The frames are resized to 128×128×4 using (5.7)-(5.9), and thepixel values are scaled between 0 and 1 using (5.10).For replay attack verification, the trained model is run using the testdatasets of the different attack scenarios, following Algorithms 5 and 6. Foreach dataset, the regularity score is computed based on the reconstructionerror using (5.13)-(5.16). The verification results for each scenario are de-scribed below:1. Scenario 1: Fig. 6.2(a) shows the regularity score plot for N = 1. Itis observed that the regularity score drops significantly at frame 29which corresponds to the interval [15, 15.5], confirming the change-point detected at tc = 15.05 hours is due to a replay attack. This456.5. PERFORMANCE EVALUATIONimplies that our proposed framework is able to detect the delay replayattack of period T = 1 hour while it is occurring.2. Scenario 2: As shown in Fig. 6.2(b), for N = 80, the regularity scorealso drops at the frame corresponding to the interval [15, 15.5], con-firming the change-point detected at tc = 15.025 hours is due to areplay attack.3. Scenario 3: Based on the monitoring results, change-points are de-tected at tc = 13.3625 and tc = 15.19 hours. However, according tothe regularity score plot shown in Fig. 6.2(c), normal regularity scoresare obtained at frame 27 which corresponds to the first change-point.On the other hand, frame 29 of the interval [15, 15.5] shows low regu-larity scores, confirming the presence of a replay attack.4. Scenario 4: The results of this scenario demonstrate how effectiveour detection and verification framework is in differentiating betweenchange-points due to replay attacks and faults. Although the moni-toring results detect change-points at tc = 15.02 and tc = 16.06 hours,as shown in Fig. 6.2(d), the regularity score drops only at frame 31,which corresponds to the interval [16, 16.5]. On the other hand, theinterval corresponding to the fault (i.e., frames 29 and 30) result in anormal regularity score.Although the four scenarios demonstrate the effectiveness of the replayattack verification, Scenarios 3 and 4 highlight the significance and necessityof the second stage of the proposed framework to verify detected change-points.6.5 Performance EvaluationBased on the results, to evaluate the performance of the second stage ofthe proposed framework, the verification time is considered. The verificationtime refers to the time at which a replay attack is confirmed. Consequently,it can be concluded that the proposed detection and verification frameworkis able to verify the existence of a replay cyberattack within 0.5 hours fordifferent replay attack scenarios (i.e., verification time is 0.5 hours), whileeliminating false alarms. As Z = 1000, each frame consists of 1000 datapoints. This implies that an attack consisting of 40000 data points is de-tected and verified by only analysing 2.5% of these data points. As a furtherevaluation, the verification rate V R is defined as follow:466.5. PERFORMANCE EVALUATION0 5 10 15 20 25 30Frame, i0.60.70.80.91.0Sr(i)tc of replay attack(a) Scenario 10 5 10 15 20 25 30Frame, i0.50.60.70.80.91.0Sr(i)tc of replay attack(b) Scenario 20 5 10 15 20 25 30Frame, i0.50.60.70.80.91.0Sr(i)tc of setpointtc of replay attack(c) Scenario 30 5 10 15 20 25 30Frame, i0.60.70.80.91.0Sr(i)tc of fault 1tc of replay attack(d) Scenario 4Figure 6.2: Regularity score plots for the four replay attack scenarios476.5. PERFORMANCE EVALUATIONV R =NV FNAF× 100 (6.1)where NV F and NAF are the number of verified replay attack frames andtotal number of replay attack frames. The verification rate corresponds tothe proposed framework’s capability to verify replay attacks. To computethis, a simulation of 100 replay attacks is performed. The replay attacksimplemented were based on the four scenarios defined. In addition, somereplay attacks were a combination of the attack scenrios 2 & 3, and scenarios2 & 4. Based on the simulation results, the proposed framework is ableto successfully verify most replay attack frames. Out of the 100 replayattacks, only 3 frames have not been verified (i.e., regularity scores are0.8861, 0.8796 and 0.8665). Accordingly, the second stage of the proposedframework demonstrates a verification rate of 97%.Besides the short verification time and high verification rate, it is stillcrucial to ensure a low false alarm rate (i.e., change-points that are not dueto replay attacks) and a reasonable detection delay (i.e., time taken to detectchange-points due to replay attacks) rate when using the first stage of theproposed framework. The false alarm rate and detection delay rate denotedas FAR and DDR, respectively, are computed as follow:FAR =NFPNFP +NTN× 100 (6.2)DDR =tc − tattackNT× 100 (6.3)where NFP represents the number of change-points detected that are notdue to a replay attack, NTN is the total number of normal data points,and NT is the duration of the replay attack. Table 6.2 shows these metricsfor the replay attack scenarios, demonstrating the adequate performanceachieved given the low values. The false alarm rate aligns with the real-timemonitoring results discussed in Section 6.3, where Scenarios 3 and 4 have afalse alarm rate of 6.67%. For the detection delay, Scenarios 1 and 3 show aslightly higher rate, in comparison with Scenarios 2 and 4. This is explainedby the short duration of the attack in Scenario 1 and the random nature ofthe attack in Scenario 3 that results in high matrix profile values instead oflow values (i.e., values close to zero).486.6. COMPARISON WITH SOME EXISTING DATA-DRIVEN REPLAY ATTACK DETECTION METHODSTable 6.2: Performance Evaluation of Replay Attack ScenariosScenario False Alarm Rate Detection Delay Rate1 0% 5%2 0% 0.125%3 6.67% 0.95%4 6.67% 0.3%To further evaluate the performance of the proposed framework, severalreplay attacks are implemented in the same simulation run. The total sim-ulation time was 90 hours, where replay attacks of all four scenarios wereperformed over the following intervals Iattack = {[14, 34], [39, 54], [56.5, 66.5],[69, 83], [86, 90]}. Overall, a significantly low false alarm rate of 0.04% anda detection delay rate of 3.17% was achieved. In addition, the presence ofthe second stage of the proposed framework provides the elimination of falsealarms by confirming the existence of replay attacks.6.6 Comparison with Some Existing Data-DrivenReplay Attack Detection MethodsAs mentioned in Chapter 2, the proposed detection and verificationframework addresses the shortcomings of the existing data-driven replay at-tack detection methods, outperforming the existing methods with enhancedperformance. Table 6.3 shows the performance of the replay attack detec-tion performed using the methods in [30], [31], and [32]. It is importantto note that the comparison is performed in the context of stage I of theproposed framework (i.e., performing change-point detection on the resultsof these methods). All methods provide a missed alarm rate of 40%, whichis due to their inability to detect replay attacks of scenarios 1 and 3. Theperformance of these methods emphasises the need for replay attack detec-tion and verification based on distinct features to verify different scenariosof replay attacks and eliminate any false alarms.496.7. OTHER DESIGN CONSIDERATIONSTable 6.3: Performance Evaluation of Replay Attack Detection using Exist-ing MethodsMethod False Alarm Rate Detection Delay Rate Missed Alarm RateTransfer Entropy* [31] 6.4% 5.6% 40%Permutation Entropy [30] 7.21% 5.2% 40%Self-Correlation Coefficient [32] 13% 8% 40%* Transfer entropy is computed between reactor pressure and purge rate6.7 Other Design Considerations6.7.1 Implementation of Stage I with CUSUM forChange-point DetectionAs mentioned in Chapter 4, EWMA and CUSUM are computationallysimilar. Therefore, to further validate the utilisation of EWMA, change-point detection using CUSUM was implemented. Table 6.4 shows the per-formance evaluation of CUSUM in comaprsion to EWMA, based on which itcan be concluded that CUSUM provides a worse performance than EWMA.Table 6.4: Performance Comparison of CUSUM with EWMAMethod False Alarm Rate Detection Delay RateCUSUM 10.66% 5.6%EWMA 0.04% 3.17%6.7.2 Removal of Matrix Profile and Spectro-TemporalFeature ExtractionIf only time series measurements were considered, it would be impos-sible to detect the replay attack in a timely manner. To confirm this, areplay attack based on Scenario 2 was performed by repeatedly injectingrecorded reactor pressure measurements of period T = 1 hour for the inter-val Iattack = [15, 35]. Since the data is not in the form of images anymore, theconvolutional layers are eliminated and the replay attack detection is per-formed using an LSTM-AE instead. As shown in Fig. 6.3, the replay attackcan only be detected at the end of its duration at t = 35 hours, due to thesudden change the attack caused in the sensor measurements. In addition,utilising time series data for detection imposes a substantial computational506.7. OTHER DESIGN CONSIDERATIONS0 10 20 30 40 50Time, t [hrs]2790279528002805reactorpressure,Y7NormalReplay AttackFigure 6.3: Replay attack detection results using only time series reactorpressure measurementsburden, with a real-time detection time of 2200 ms/step, where the step isdefined based on the total number of data points over the epoch. This issignificantly higher than the proposed framework’s time of 264 ms/step, asa result of the spectrogram image frames (i.e., the step is based on the totalnumber of image frames).6.7.3 Removal of Fusion Time Series DataIn a way to reduce computational complexities, spectrogram image framescan be generated using the original time series, instead of the fusion timeseries. Despite the computational efficiency, it is not efficient for all replayattack scenarios defined. For Scenario 1, although a change-point may bedetected, the second stage is not able to detect the delay replay attack caus-ing the change-point. This limitation arises from the absence of any distinctpatterns in the spectrogram image frames generated from the original timeseries data. Consequently, the generation of a fusion time series based onthe matrix profile becomes crucial, as it creates distinguishable patternsthat can be leveraged to verify the presence of a replay attack. To illustratethis, the verification for the delay replay attack described in Section 6.3 is516.7. OTHER DESIGN CONSIDERATIONSperformed. A change-point is detected at tc = 15.4 hours, prompting theexecution of the second stage of the proposed framework using the originaltime series data. The detection method is only able to detect the delayreplay attack at frame 15, which is at 16 hours (i.e., after the attack ended).Figs. 6.4(a) and 6.4(b) show the spectrogram of the original time series dataand the fusion time series data, respectively. It can be observed that thedelay replay attack has a distinct pattern in the spectrogram of the fusiontime series data, which is not observed in the spectrogram of the originaltime series data.6.7.4 Effect of Subsequence Length k on Generated MatrixProfileThe effect of the chosen subsequence length k in detection depends on thenumber of samples in the recorded period T used for the replay attack. Forinstance, it is assumed that for a replay attack performed using a recordedperiod T = 0.25 hour, which consists of 500 samples for fs = 2000, asubsequence length of k = 1000 is chosen. For the case of a delay replayattack (N = 1), the matrix profile will not generate a distinct pattern forthe replay attack. On the other hand, for the case of repeated attack (N >1), the matrix profile will generate a distinct pattern, but after a delayof 0.25 hours. Generally, to ensure the detection of the replay attack thesubsequence length should be k ≤ fsT , hence, the choice of k = 100 in thisthesis.6.7.5 Effect of Smoothing Factor α on Change-pointDetectionThe smoothing factor α in EWMA affects the sensitivity of the change-point detection. It determines how quickly the moving average responds tochanges in the underlying data. A higher α (i.e., closer to 1) gives moreweight to recent data points, resulting in a smoother and more stable aver-age. As a consequence, it becomes less sensitive to changes in the data. Onthe other hand, a lower α (i.e., closer to 0) assigns more weight to past datapoints, resulting in a more sensitive response to changes. A comparison ofthe different values α = {0.1, 0.2, 0.4, 0.7, 0.9} is presented based on the falsealarm rate, detection delay rate, and missed alarm rate performance met-rics, as shown in Table 6.5. Based on the table, the selected value α = 0.2provides the best monitoring performance, ensuring all possible replay at-tacks are detected (i.e., missed alarm rate is 0%) while having a low false526.7. OTHER DESIGN CONSIDERATIONS(a) Original Time Series Data(b) Fusion Time Series DataFigure 6.4: Spectrogram generated for original time series data and fusiontime series data, with a replay attack of Scenario 1536.7. OTHER DESIGN CONSIDERATIONSalarm rate.Table 6.5: Comparison of Different Values of αα False Alarm Rate Detection Delay Rate Missed Alarm Rate0.1 0.342% 3.17% 0%0.2 0.04% 3.17% 0%0.4 0.029% 95% 60%0.7 0.0029% 99.9% 90%0.9 0% −∗ 100%* Detection delay is not applicable since no attacks are detected6.7.6 Effect of Scaling Factor λ and Number ofSpectrogram Image FramesThe scaling factor λ determines the number of image frames i a spec-trogram is split into based on the length Z. As a result, it also affects thedetection time frame. The higher the value of λ, the lower the number ofspectrogram image frames. Although this is computationally efficient, italso results in a longer detection time. For example, if λ = 4, a spectrogramwill be split into i = 24 spectrogram image frames, each of length Z = 4000samples. Following Scenario 1, a replay attack causing the change-pointdetected at tc = 15.05 is at the frame corresponding to the interval [15, 17].This means that the replay attack is detected within 2 hours of its occur-rence, which is inefficient specifically for the case of a delay replay attackas the detection would be after the attack ends. On the other hand, val-ues of λ < 1 would provide shorter verification times, but with a highercomputational cost.6.7.7 Effect of Overlap OThe value of the overlap O affects the temporal resolution of the spec-trogram image frame. A comparison of different overlap values of O ={0.25L, 0.5L, 0.7L,L − 1} based on the window size L is performed. Ta-ble 6.6 shows the replay attack detection interval results based on Scenario2, where it can be observed that the verification time is delayed for lower val-ues of O. Based on Section III-C, for a change-point detected at tc = 15.025hours, the verification of the replay attack occurs at least 1.285 hours af-ter the detected attack (16.31 hours being the earliest verification time),546.8. SUMMARYcreating a 36.96% increase in the verification time, in comparison with theoverlap of L− 1.Table 6.6: Comparison of Different Values of Overlap OOverlap O Verification Interval0.25L [16.128, 16.896]0.5L [15.84, 16.31]0.7L [15.81, 16.32]L− 1 (used in this thesis) [15, 15.5]6.8 SummaryThis chapter provides an implementation of the proposed frameworkthrough a case study using the Tennessee Eastman process benchmark sim-ulation system/model. The effectiveness of the framework in detecting re-play attacks is demonstrated, providing low false alarm and detection delayrates. Furthermore, the framework ensures timely verification for all fourreplay attack scenarios defined.55Chapter 7Conclusion7.1 SummaryThis thesis comprehensively addresses data-driven detection and veri-fication of replay attacks on industrial control systems, through a noveltwo-stage framework. The first stage consists of continuous real-time moni-toring of sensor measurement patterns using change-point detection on thecorresponding matrix profile. The detection of a change-point indicatesthe possibility of a replay attack. The second stage of the framework ver-ifies whether the detected change-point is actually due to a replay attack.Unlike existing data-driven detection methods, the framework introducesadditional features to a newly defined fusion time series data, through aspectro-temporal feature extraction phase using short-time Fourier trans-form, allowing the detection of replay attacks based on distinct features.The time-frequency spectrograms generated are then converted into imageframes to create temporal sequences. The ConvLSTM-AE is then trainedusing normal image frames and replay attacks are detected based on the re-construction error. Through this two-stage framework, timely replay attackdetection and verification is achieved for different scenarios using distinctfeatures based in a real-time implementation. To the best of the author’sknowledge, this work presents the first comprehensive data-driven replayattack detection and verification in the literature.7.2 Limitations and Future ResearchEven though the proposed framework has shown promising results in thedetection and verification of replay attacks on industrial control systems,there are still some limitations that should be addressed in future work.These limitations include:1. Fixed replay attack verification time: Although the proposed frame-work provides prompt replay attack verification time for most cases,567.2. LIMITATIONS AND FUTURE RESEARCHthe verification time, which is based on λ, provides a minimum thresh-old for which faster verification is not possible.2. Detection of multiple replay attacks simultaneously: The proposedframework is only performed for the detection and verification of re-play attacks on a single sensor measurement. In real ICS, replay at-tacks may be executed on several sensor measurements simultaneously.Although the proposed framework can be implemented for each con-troller independently, it is still necessary to explore this replay attacksscenario.3. Detection of covert attacks: A sophisticated version of the replay at-tack is covert attack, where model knowledge is utilised to change thesystem inputs while the effect is disguised on the output.4. Optimisation of the framework parameters: The optimisation of theparameters involved in change-point detection and replay attack veri-fication should be explored for the improvement of the detection andverification framework.57Bibliography[1] T. Alladi, V. Chamola, and S. Zeadally, “Industrial control systems:Cyberattack trends and countermeasures,” Computer Communications,vol. 155, pp. 1–8, 2020. → pages 1[2] K. E. Hemsley and R. E. Fisher. “History of industrial control sys-tem cyber incidents,” Idaho Falls, ID, USA, 2018. [Online]. Available:https://www.osti.gov/servlets/purl/1505628. → pages 1[3] Trend Micro, “An In-Depth Look at ICS Vulnerabilities Part 1,”in Verve Industrial Resources, March, 2022. [Online]. Available:https://www.trendmicro.com/frfr/research/22/c/an-in-depth-look-at-ics-vulnerabilities-part-1.html. → pages 1[4] Dragos, “2022 ICS/OT VULNERABILITIES,” 2022. [Online]. Avail-able: https://www.dragos.com/year-in-review/section-vulnerabilities.→ pages 1[5] A. Teixeira, I. Shames, H. Sandberg, and K. H. Johansson, “A securecontrol framework for resource-limited adversaries,” Automatica, vol. 51,pp. 135–148, 2015. → pages x, 2, 3[6] A. W. Al-Dabbagh, A. Barboni, and T. Parisini, “Distributed detectionand isolation of covert cyber attacks for a class of interconnected sys-tems,” in IFAC-PapersOnLine, vol. 53, no. 2, pp. 772–777, 2020. →pages 2[7] Y. Li, J. Wang, R. Wang, D. W. Gao, Q. Sun, and H. Zhang, “A switchedNewton–Raphson-based distributed energy management algorithm formultienergy system under persistent DoS attacks,” IEEE Transactionson Automation Science and Engineering, vol. 19, no. 4, pp. 2985–2997,2022. → pages 2[8] C. Hu, S. Ding, and X. Xie, “Event-based distributed set-membershipestimation for complex networks under deception attacks,” IEEE Trans-58Bibliographyactions on Automation Science and Engineering (Early Access), 2023.→ pages 2[9] S. Karnouskos, “Stuxnet worm impact on industrial cyber-physical sys-tem security,” in Proceedings of the 37th Annual Conference of the IEEEIndustrial Electronics Society, pp. 4490–4494, 2011. → pages 4[10] Y. Mo, S. Weerakkody, and B. Sinopoli, “Physical authentication ofcontrol systems: Designing watermarked control inputs to detect coun-terfeit sensor outputs,” IEEE Control Systems Magazine, vol. 35, no. 1,pp. 93–109, 2015. → pages 7[11] A. W. Al-Dabbagh, W. Hu, S. Lai, T. Chen, and S. L. Shah, “Towardthe advancement of decision support tools for industrial facilities: Ad-dressing operation metrics, visualization plots, and alarm floods,” IEEETransactions on Automation Science and Engineering, vol. 15, no. 4, pp.1883–1896, 2018. → pages 7[12] A. W. Al-Dabbagh and T. Chen, “Sounding off on industrial alarmsystems,” IEEE Potentials, vol. 37, no. 2, pp. 24–28, 2018. → pages 7[13] A. W. Al-Dabbagh, Y. Li, and T. Chen, “An intrusion detection systemfor cyber attacks in wireless networked control systems,” IEEE Trans-actions on Circuits and Systems II: Express Briefs, vol. 65, no. 8, pp.1049–1053, 2018. → pages 7[14] Y. Mo and B. Sinopoli, “Secure control against replay attacks,” in Pro-ceedings of the 47th Annual Allerton Conference on Communication,Control, and Computing, pp. 911–918, 2009. → pages 7[15] B. Satchidanandan and P. R. Kumar, “Dynamic watermarking: Activedefense of networked cyber-physical systems,” Proceedings of the IEEE,vol. 105, no. 2, pp. 219–240, 2017. → pages 8[16] A. Barboni, A. W. Al-Dabbagh, and T. Parisini, “An event-triggeredwatermarking strategy for detection of replay attacks,” in IFAC-PapersOnLine, vol. 55, no. 6, pp. 317–322, 2022. → pages 8[17] A. Hoehn and P. Zhang, “Detection of replay attacks in cyber-physicalsystems,” in Proceedings of American Control Conference, pp. 290–295,2016. → pages 859Bibliography[18] D. Ye, T.Y. Zhang, and G. Guo, “Stochastic coding detection schemein cyber-physical systems against replay attack,” Information Sciences,vol. 481, pp. 432–444, 2019. → pages 8[19] H. S. Sanchez, D. Rotondo, T. Escobet, V. Puig, J. Saludes, and J.Quevedo, “Detection of replay attacks in cyberphysical systems using afrequency-based signature,” Journal of the Franklin Institute, vol. 356,no. 5, pp. 2798–2824, 2019. → pages 8[20] J. Li, Z. Wang, Y. Shen, and L. Xie, ”Attack detection for cyber-physical systems: A zonotopic approach,” IEEE Transactions on Auto-matic Control (Early Access), 2023. → pages 8[21] Y. Raghuvamsi and K. Teeparthi, “Detection and reconstruction ofmeasurements against false data injection and DoS attacks in distribu-tion system state estimation: A deep learning approach,” Measurement,vol. 210, 2023. → pages 8[22] A. Al-Abassi, H. Karimipour, A. Dehghantanha, and R. M. Parizi,“Anensemble deep learning-based cyber-attack detection in industrial controlsystem,” IEEE Access, vol. 8, pp. 83965–83973, 2020. → pages 8[23] K. D. Lu, G. Q. Zeng, X. Luo, J. Weng, W. Luo, and Y.Wu,“Evolutionary deep belief network for cyber-attack detection in in-dustrial automation and control system,” IEEE Transactions on Indus-trial Informatics, vol. 17, no. 11, pp. 7618–7627, 2021. → pages 8[24] M. Kravchik and A. Shabati, “Efficient cyber attack detection in indus-trial control systems using lightweight neural networks and PCA,” IEEETransactions on Dependable and Secure Computing, vol. 19, no. 4, pp.2179–2197, 2021. → pages 8[25] M. Zhu and S. Martinez, “On the performance analysis of resilientnetworked control systems under replay attacks,” IEEE Transactions onAutomatic Control, vol. 59, no. 3, pp. 804—808, 2014. → pages 9[26] H. Zhang, Y. Diao, and N. Immerman, “Recognizing patterns instreams with imprecise timestamps,” Information Systems, vol. 38, pp.1187-–1211, 2013. → pages 9[27] F. Farha and H. Ning, “Enhanced timestamp scheme for mitigatingreplay attacks in secure Zigbee networks,” in Proceedings of the 2019IEEE International Conference on Smart Internet of Things, pp. 469—473, 2019. → pages 960Bibliography[28] I. Kiss, B. Genge, and P. Haller, “A clustering-based approach to detectcyber attacks in process control systems,” in Proceedings of the 13thIEEE International Conference on Industrial Informatics, pp. 142–148,2015. → pages 9, 10[29] R. Kumar, R. R. Hossain, S. Talukder, A. Jena, and A. T. A. Ghazo,“Recursive histogram tracking-based rapid online anomaly detection incyber-physical systems,” IEEE Transactions on Systems, Man, and Cy-bernetics: Systems, vol. 52, no. 11, pp. 7123–7133, 2022. → pages 9,10[30] M. Zhou, Z. Zhang, and L. Xie, “Permutation entropy based detectionscheme of replay attacks in industrial cyber-physical systems,” Journalof the Franklin Institute, vol. 358, no. 7, pp. 4058–4076, 2021. → pages9, 10, 49, 50[31] D. Shi, Z. Guo, K. H. Johansson, and L. Shi, “Causality countermea-sures for anomaly detection in cyber-physical systems,” IEEE Transac-tions on Automatic Control, vol. 63, no. 2, pp. 386–401, 2018. → pages9, 10, 49, 50[32] M. Ma, P. Zhou, D. Du, C. Peng, M. Fei, and H.M. AlBuflasa, “Detect-ing replay attacks in power systems: A data-driven approach,” AdvancedComputational Methods in Energy, Power, Electric Vehicles, and TheirIntegration, vol. 763, 2017. → pages 10, 49, 50[33] W. Wang, Y. Xie, L. Ren, X. Zhu, R. Chang, and Q. Yin, “Detection ofdata injection attack in industrial control system using long short termmemory recurrent neural network,” in Proceedings of the 13th IEEE Con-ference on Industrial Electronics and Applications (ICIEA), pp. 2710–2715, 2018. → pages 10[34] A. J. Gallo, M. S. Turan, F. Boem, T. Parisini, and G. Ferrari-Trecate,“A distributed cyber-attack detection scheme with application to DCmicrogrids,” IEEE Transactions on Automatic Control, vol. 65, no. 9,pp. 3800–3815, 2020. → pages 12[35] Y. Mo, R. Chabukswar, and B. Sinopoli, “Detecting integrity attacks onSCADA systems,” IEEE Transactions on Control Systems Technology,vol. 22, no. 4, pp. 1396–1407, 2014. → pages 13[36] C-C. M. Yeh, N. Kavantzas, and E. Keogh, “Matrix profile VI: Meaning-ful multidimensional motif discovery,” in Proceedings of the 2017 IEEE61BibliographyInternational Conference on Data Mining, pp. 565–574, 2017. → pages17[37] C-C. M. Yeh, Y. Zhu, L. Ulanova, N. Begum, Y. Ding, H. A. Dau, Z.Zimmerman, D. F. Silva, A. Mueen, and E. Keogh, “Time series joins,motifs, discords and shapelets: A unifying view that exploits the matrixprofile,” Data Mining and Knowledge Discovery, vol. 39, pp. 83—123,2018. → pages 17[38] S.M. Law, “STUMPY: A powerful and scalable Python library for timeseries data mining,” Journal of Open Source Software, vol. 4, no. 39, pp.1504, 2019. → pages 17[39] C-C. M. Yeh et al., “Matrix profile I: All pairs similarity joins for timeseries: A unifying view that includes motifs, discords and shapelets,” inProceedings of the IEEE 16th International Conference on Data Mining,2016. → pages 18[40] R.P. Adams and D.J. MacKay, “Bayesian online changepoint detec-tion,” 2007. in arXiv: Machine Learning → pages 19[41] H. Wang and Y. Xie, “Sequential change-point detection: Computationversus statistical performance,” 2022. in arXiv:2210.05181 → pages 22[42] M. Basseville and I. Nikiforov, “Detection of abrupt changes: Theoryand application,” Prentice Hall, vol. 104, 1993. → pages 23[43] K. Wirsing, “Time frequency analysis of wavelet and Fourier trans-form,” Wavelet theory, 2020. → pages 30[44] B. Boashash and B. Barkat, “Introduction to time-frequency signalanalysis,” Wavelet Transforms and Time-Frequency Signal Analysis, pp.321–380, 2001. → pages 30[45] G. Xin, Z. Li, L. Jia, Q. Zhong, H. Dong, N. Hamzaoui, and J. Antoni,“Fault diagnosis of wheelset bearings in high-speed trains using logarith-mic short-time Fourier transform and modified self-calibrated residualnetwork,” IEEE Transactions on Industrial Informatics, vol. 18, no. 10,pp. 7285–7295, 2021. → pages 30[46] J. CusidO´Cusido, L. Romeral, J. A. Ortega, J. A. Rosero, and A. G. Es-pinosa, “Fault detection in induction machines using power spectral den-sity in wavelet decomposition,” IEEE Transactions on Industrial Elec-tronics, vol. 55, no. 2, pp. 633–643, 2008. → pages 3062Bibliography[47] J. Q. James, Y. Hou, and V. O. Li,“Online false data injection at-tack detection with wavelet transform and deep neural networks,” IEEETransactions on Industrial Informatics, vol. 14, no. 7, pp. 3271–3280,2018. → pages 30[48] D. Gabor, “Theory of communication. Part 1: The analysis of informa-tion,” Journal of the Institution of Electrical Engineers - Part III: Radioand Communication Engineering, vol. 93, no. 26, pp. 429–441, 1946. →pages 30[49] L. Cohen, “The uncertainty principle for the short-time Fourier trans-form and wavelet transform,” Wavelet Transforms and Time-FrequencySignal Analysis, pp. 217–232 2001. → pages 31[50] B. McFee, “Spectral leakage and windowing,” Digital Signals Theory,2020. → pages 31[51] N. M. Rezk, M. Purnaprajna, T. Nordstro¨m, and Z. Ul-Abdin, “Re-current neural networks: An embedded computing perspective,” IEEEAccess, vol. 8, pp. 57967–57996, 2020. → pages 34[52] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” NeuralComputation, vol. 9, pp. 1735–1780, 1997. → pages 34[53] A. Sherstinsky, “Fundamentals of recurrent neural network (RNN) andlong short-term memory (LSTM) network,” Physica D: Nonlinear Phe-nomena, vol. 404, 2020. → pages 34[54] X, Shi, Z. Chen, H. Wang, D.-Y. Yeung, W.-K. Wong, and W.-C. Woo,“Convolutional LSTM network: A machine learning approach for precip-itation nowcasting,” in Proceedings of the 28th International Conferenceon Neural Information Processing Systems, vol. 1, pp. 802–810, 2015. →pages 35[55] B. R. Kiran, D. M. Thomas, and R. Parakkal, “An overview of deeplearning based methods for unsupervised and semi-supervised anomalydetection in videos,” Journal of Imaging, vol. 4, no. 2, pp. 36, 2018. →pages 36, 38[56] J. Downs and E. F. Vogel, “Plant-wide industrial process control prob-lem,” Computers and Chemical Engineering, vol. 19, pp. 949–959, 1995.→ pages 4063Bibliography[57] M. Krotofil and J. Larsen, “Damn vulnerable chemical process,” inProceedings of the 31st Chaos Communication Congress, 2014. → pages40[58] N. Bathelt, L. Ricker, and M. Jelali, “Revision of the Tennessee East-man process model,” in Proceedings of the 9th IFAC Symposium on Ad-vanced Control of Chemical Processes, vol. 48, no. 8, pp. 309–314, 2015.→ pages 40[59] D. P. Kingma, and J. Ba, “Adam: A method for stochastic optimiza-tion,” 2014. in arXiv: 1412.6980 → pages 4164
Thesis/Dissertation
eng
Electrical Engineering
Vancouver : University of British Columbia Library
Attribution-NonCommercial-NoDerivatives 4.0 International
Graduate
Al-Dabbagh, Ahmad
Feng, Chen
Data-driven detection and verification of replay attacks on industrial control systems
Text