Anomaly Detection in Aging Industrial Internet of Things

Abstract

The Industrial Internet of Things (IIoT) have been designed to perform a more agile and efficient automation, control, and orchestration of future industrial systems while improving the energy efficiency in smart factories. Unfortunately, while the benefits of the IIoT are undeniable, their pervasive adoption as key enablers for future industries also paved the way for new security risks. In fact, the damaging effects of exploiting vulnerable IIoT have been repeatedly demonstrated and publicly reported. The Mirai botnet, various reports on hackable and invasive devices, alongside the infamous Stuxnet malware, constitute significant proof on the undisputed and disruptive effect of the malware-targeting IIoT systems. As a response, a plethora of solutions has been developed to address the issue of securing IIoT systems in specific sectors. Nevertheless, we believe that the gradual decay of the IIoT's physical dimension (e.g., the physical process), also called aging, is a natural component of the IIoT's life cycle, which has not received sufficient attention from the scientific community. This paper develops a methodology for detecting abnormal behavior in the context of aging IIoT. The approach leverages multivariate statistical analysis [e.g., principle component analysis (PCA)], alongside the Hotelling's T <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> statistics, and the univariate cumulative sum in order to detect abnormal process events. An innovative feature of the developed approach is the detection of stealth attacks attempting to influence the dataset in each age. The extensive experimental results on a continuous stirred-tank reactor (CSTR) model demonstrate its applicability to the IIoT and its superior performance to the recently reported techniques.