.png){kind=icon}
.png){kind=icon}
Return
Process-Oriented heterogeneous graph learning in GNN-Based ICS anomalous pattern recognition
.png){kind=icon}
PRE
AI
DOI：10.1016/j.patcog.2023.109661.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Over the past few years, massive penetrations targeting an Industrial Control System (ICS) network intend to compromise its core industrial processes. So far, numerous advanced methods have been proposed to detect anomalous patterns in the numeric data streams with respect to the heterogeneous field devices involved in the industrial processes. These methods, despite reporting decent results, usually conduct system-wise detection instead of fine-grained anomalous pattern recognition at the device level. Further-more, lacking explicit consideration of the exclusive process-related features with respect to each differ-entiated device, the fitness of their application in specified industrial processes is undermined. To tackle these issues, a GNN-based Attributed Heterogeneous Graph Analyzer (the AHGA) is designed to perform device-wise anomalous pattern detection via in-depth process-oriented associativity learning. The AHGA's framework is constructed with four building blocks: a graph processor, a feature analyzer, a link inference decoder, and an anomaly detector. Its performance is assessed and compared against multiple link infer-ence and anomaly detection baselines over 2 popular ICS datasets (SWaT and WADI). Comparative results demonstrate the AHGA's reliability in capturing sophisticated process-oriented relations among heteroge-neous devices as well as its effectiveness in boosting the performance of anomalous pattern recognition at device-level granularity. (c) 2023 Elsevier Ltd. All rights reserved.
Keywords:
Fine-Grained anomaly recognition
Process-Oriented associativity
Heterogeneous graph learning
Industrial control systems
Journal
IF:
7.6
Papers:
1.3W
Citations:
4.5W