https://www.mdu.se/

As critical infrastructure increasingly relies on Industrial Control Systems (ICS), these systems have become a prime target for cyberattacks. As a result of the move towards Industry 4.0 targets, ICSs are increasingly being connected to the outside world, which makes them even more vulnerable to attacks. To enhance the ICS's security, Intrusion Detection Systems (IDS) are used in detecting and mitigating attacks. However, using real ICS installations for testing IDS can be challenging, as any interference with the ICS could have serious consequences, such as production downtime or compromised safety. Alternatively, ICS testbeds and cybersecurity datasets can be used to analyze, validate, and evaluate the IDS capabilities in a controlled environment. In addition, the complexity of ICSs, combined with the unpredictable and intricate nature of attacks, present a challenge in achieving high detection precision using traditional rule-based models. To tackle this challenge, Machine Learning (ML) have become increasingly attractive for identifying a broader range of attacks.

This thesis aims to enhance ICS cybersecurity by addressing the mentioned challenges. We introduce a framework for simulation of virtual ICS security testbeds that can be customized to create extensible, versatile, reproducible, and low-cost ICS testbeds. Using this framework, we create a factory simulation and its ICS to generate an ICS security dataset. We present this dataset as a validation benchmark for intrusion detection methods in ICSs. Finally, we investigate the efficiency and effectiveness of the intrusion detection capabilities of a range of Machine Learning techniques. Our findings show (1) that relying solely on intrusion evidence at a specific moment for intrusion detection can lead to misclassification, as various cyber-attacks may have similar effects at a specific moment, and (2) that AI models that consider the temporal relationship between events are effective in improving the ability to detect attack types.

The growing connectivity of Industrial Control Systems (ICS) has increased their exposure to cyber threats, posing serious risks to both critical infrastructure (e.g., power plants, water systems) and industrial operations. Although Machine Learning (ML)-based Intrusion Detection Systems (IDS) show potential to detect complex and novel attacks, their practical application in ICS environments remains challenging. This thesis investigates the feasibility, design considerations, and barriers to applying ML-based IDS in ICSs. Key challenges include limited labeled data, high sensitivity to false alarms, distributed architectures, and constrained hardware. Through empirical evaluations and prototype implementations, we show how tailored ML and system design strategies can address these issues.

Our first goal is to enable experimentation with cybersecurity and intrusion detection in industrial systems. The thesis introduces ICSSIM, a novel framework for creating flexible, scalable, and cost-effective ICS testbeds.  It also presents ICSFlowGenerator, a tool for analyzing network traffic and computing customized network flow parameters. Using this tool, the thesis presents ICS-Flow, a new dataset developed to train and evaluate anomaly detection models, which serves as a realistic benchmark for assessing ML-based intrusion detection in ICS networks. 

In addition, the thesis tackles several technical deployment barriers. To support distributed ICS architectures and minimize the reliance on central servers, federated learning is explored as a decentralized training strategy. It also investigates semi-supervised learning techniques for detecting anomalies using only normal traffic.  To reduce the burden of false alarms, we integrate a decision support system with the IDS to filter alerts and suggest mitigation actions. Furthermore, the thesis emphasizes the importance of temporal traffic patterns in identifying attack types and evaluates the efficiency and resource demands of various ML models on ICS-representative hardware. Collectively, these contributions advance the practical application of ML-based intrusion detection in ICSs.

Digitaliseringen och ökande uppkoppling av industriella styrsystem (ICS) har medfört ökad exponering för cyberhot och innebär allvarliga risker för både kritisk infrastruktur (t.ex. kraftverk, vattensystem) och industriella verksamheter. Även om intrångsdetekteringssystem (IDS) baserade på maskininlärning (ML) har potential att upptäcka komplexa och nya attacker, är deras praktiska tillämpning i ICS-miljöer fortfarande utmanande. I den här avhandlingen analyseras genomförbarheten, designöverväganden och hinder för att applicera ML-baserade IDS i ICS. Centrala utmaningar omfattar begränsad mängd annoterad data, hög känslighet för falsklarm, distribuerade arkitekturer och hårdvarubegränsningar. Genom empiriska utvärderingar och prototypimplementeringar visar vi hur skräddarsydda ML- och systemdesignstrategier kan adressera dessa problem.

Det första målet är att möjliggöra cybersäkerhetsexperiment och detektion av intrång i industriella system. Avhandlingen introducerar ICSSIM, ett nytt ramverk för att skapa flexibla, skalbara och kostnadseffektiva ICS-testbäddar. Vi har dessutom utvecklat ICSFlowGenerator, ett verktyg för att analysera nätverkstrafik och beräkna anpassade nätverksflödesparametrar. Med hjälp av detta verktyg har vi skapat ICS-Flow, en ny datamängd (dataset) för att träna och utvärdera anomalidetekteringsmodeller. ICS-Flow fungerar som en realistisk benchmark för att bedöma ML-baserad intrångsdetektering i ICS-nätverk. 

Med stöd av ICS-Flow adresserar avhandlingen flera tekniska hinder vid driftsättning. För att stödja distribuerade ICS-arkitekturer och minimera beroendet av centrala servrar utforskas en decentraliserad träningsstrategi. Vi undersöker även semi-övervakade inlärningstekniker för att detektera anomalier med enbart normal trafik. För att minska risken för falsklarm integrerar vi ett beslutsstödssystem med IDS:en för att filtrera larm och föreslå åtgärder. Vidare betonar avhandlingen betydelsen av tidsberoende trafikmönster för att identifiera attacktyper och utvärderar effektivitet och resurskrav för olika ML-modeller på ICS-representativ hårdvara. Sammantaget främjar dessa bidrag den praktiska tillämpningen av ML-baserad intrångsdetektering för ICS.