GRU-based Buzzer Ensemble for Abnormal Detection in Industrial Control燬ystems

Recently, Industrial Control Systems (ICSs) have been changing from a closed environment to an open because of the expansion digital transformation, smart factories, and Internet Things (IIoT). Since security accidents that occur in ICSs can cause national confusion human casualties, research on detecting abnormalities by using normal operation data learning is being actively conducted. The single technique proposed existing studies does not detect well or provide satisfactory results. In this paper, we propose GRU-based Buzzer Ensemble for Abnormal Detection (GBE-AD) model anomalies industrial control systems ensure rapid response process availability. newly ensemble buzzer method resolves False Negatives (FNs) complementing limited range be detected internal models composing GBE-AD. Because remain suppressed Positives (FPs), GBE-AD provides better generalization. addition, generated mean prediction error inferred abnormal processes soft hard clustering. We confirmed detection model's Time-series Aware Precision (TaP) FPs at 97.67%. final performance was 94.04% experiment HIL-based Augmented ICS (HAI) Security Dataset (ver.21.03) among public datasets.