Super-learner ensemble for anomaly detection and cyber-risk quantification in industrial control systems

Abstract

Industrial Control Systems (ICS) are integral parts of smart cities and critical to modern societies. Despite indisputable opportunities introduced by disruptor technologies, they proliferate the cybersecurity threat landscape, which is increasingly more hostile. The quantum of sensors utilised by ICS aided by Artificial Intelligence (AI) enables data collection capabilities to facilitate automation, process streamlining and cost reduction. However, apart from operational use, the sensors generated data combined with AI can be innovatively utilised to model anomalous behaviour as part of layered security to increase resilience to cyber-attacks. We introduce a framework to profile anomalous behaviour in ICS and derive a cyber-risk score. A novel super learner ensemble for one-class classification is developed, using overlapping rolling windows with stratified, k-fold, n-repeat cross-validation applied to each base-learner followed by majority voting to derive the best learner. Our approach is demonstrated on a liquid distribution sensor dataset. The experimental results reveal that the proposed technique achieves an overall F1-score of 99.13%, an anomalous recall score of 99% detecting anomalies lasting only 17 seconds. The key strength of the framework is the low computational complexity and error rate. The framework is modular, generic, applicable to other ICS and transferable to other smart city sectors.