Cybersecurity of Industrial Cyber-Physical Systems is drawing significant
concerns as data communication increasingly leverages wireless networks. A lot
of data-driven methods were develope for detecting cyberattacks, but few are
focused on distinguishing them from equipment faults. In this paper, we develop
a data-driven framework that can be used to detect, diagnose, and localize a
type of cyberattack called covert attacks on networked industrial control
systems. The framework has a hybrid design that combines a variational
autoencoder (VAE), a recurrent neural network (RNN), and a Deep Neural Network
(DNN). This data-driven framework considers the temporal behavior of a generic
physical system that extracts features from the time series of the sensor
measurements that can be used for detecting covert attacks, distinguishing them
from equipment faults, as well as localize the attack/fault. We evaluate the
performance of the proposed method through a realistic simulation study on a
networked power transmission system as a typical example of ICS. We compare the
performance of the proposed method with the traditional model-based method to
show its applicability and efficacy.

基于数据驱动的框架，结合变分自编码器 (VAE)、循环神经网络 (RNN) 和深度神经网络 (DNN)，用于检测、诊断和定位网络工业控制系统中的隐蔽攻击。通过在网络化的电力传输系统上进行仿真研究，我们评估了该方法的性能，并与传统基于模型的方法进行比较，以展示其适用性和效力。