Digital model based intrusion detection for improved cyber security in a water distribution system

Abstract

Improved real-time data collection and processing have resulted in the interconnection of cyber-physical systems (CPSs) components including sensors, actuators, network devices with other intelligent devices in cyber space. This development comes with challenges especially in terms of cybersecurity. Considering the increase in threats that may lead to data theft and equipment damage when attacked by hackers or intruders, the urgent need is to proffer enhanced measures that will improve the cybersecurity of water distribution (WaDi) CPSs driven by machine learning. Herein, intrusion detection is of great interest when it comes to safeguarding CPSs from such targeted and sophisticated attacks that abound in CPSs. They aim to detect behaviors of components of the CPS that do not conform with the normal operations of a CPS or alter its processes. Machine learning approaches have provided the necessary means to learn and the ability to identify intrusions in a CPS. A new type of information technology called digital object (DO) makes it possible to turn the real world into a virtual digital environment. Machine learning is applied on the data generated from the DO to predict the behaviors of components of the CPS during attack and normal operations. DO, which is a direct replica of the physical object, has been used in industries to study system behavior and predict system performance. This paper adopted the Digital HydrAulic SIMulator (DHALSIM) for generating synthetic datasets subjected to machine learning. A WaDi network use case is also adopted to mimic a real-world water distribution system (WDS). The physical, network, and control processes of an operational CPS were also captured. This research focuses on the behavior of physical processes. Attacks were simulated on DHALSIM to also establish the behavior of the system in times of attacks. A machine learning algorithm such as random forest (RF) algorithm is applied to the generated dataset with the intention of ascertaining the performance and behavior of the algorithm on the generated dataset and that acquired from iTrust. Finally, the application of RF machine learning algorithm predicted the behavior (physical processes) of a WDS (normal or abnormal), thus improving anomaly detections in CPS.