Programmable logic controller (PLC) based industrial control systems (ICS)
are used to monitor and control critical infrastructure. Integration of
communication networks and an Internet of Things approach in ICS has increased
ICS vulnerability to cyber-attacks. This work proposes novel unsupervised
machine learning ensemble methods for anomaly detection in PLC-based ICS. The
work presents two broad approaches to anomaly detection: a weighted voting
ensemble approach with a learning algorithm based on coefficient of
determination and a stacking-based ensemble approach using isolation forest
meta-detector. The two ensemble methods were analyzed via an open-source
PLC-based ICS subjected to multiple attack scenarios as a case study. The work
considers four different learning models for the weighted voting ensemble
method. Comparative performance analyses of five ensemble methods driven
diverse base detectors are presented. Results show that stacking-based ensemble
method using isolation forest meta-detector achieves superior performance to
previous work on all performance metrics. Results also suggest that effective
unsupervised ensemble methods, such as stacking-based ensemble having isolation
forest meta-detector, can robustly detect anomalies in arbitrary ICS datasets.
Finally, the presented results were validated by using statistical hypothesis
tests.

本文提供了两种无监督机器学习方法，用于 PLC 基础 ICS 中的异常检测，分别是加权投票集成方法和使用孤立森林元检测器的堆叠集成方法。研究结果表明，使用孤立森林元检测器的堆叠集成方法在所有性能指标上优于以往的方法，并可以稳健地检测任意 ICS 数据集中的异常。