NeuroPAD: A Neural Process-level Anomaly Detection for Industrial Control Systems

工业控制系统（ICS）是指用于监视和控制制造、生产和分销等工业过程的信息系统。虽然早期的ICSs在物理上与外部隔离，但今天的ICSs已经发展成为与公共互联网集成。不幸的是，将ICSs连接到互联网会产生许多针对它们的新威胁和攻击，最近世界各地发生的几起备受瞩目的事件就是明证。传统的现成IT安全解决方案不适合防御针对ICS的隐形攻击。为了抵御这种新的威胁格局，需要针对ICS量身定制的攻击预防和检测新方法。 NeuroPAD项目是关于ICS中的过程级异常检测。NeuroPAD项目的假设是，ICS控制的物理过程可以通过其输入和输出进行建模，以确认发送到现场设备的控制命令被正确执行，并且来自传感器的信息与系统的预期行为一致。它建议通过开发纯数据驱动的方法来实现这一目标，在这种方法中，使用人工神经网络从直接的系统观察中学习物理过程的动态。 工业控制系统对加拿大关键基础设施的运行至关重要。NeuroPAD项目预计将产生新的理论见解和工程指南，作为ICS网络安全产品创新设计的基础。这不仅将通过瞄准不断扩大的市场产生经济影响，还将通过创造可用于保护影响全国加拿大人生活和福祉的重要关键基础设施和工业流程的解决方案产生社会影响。

Industrial control system (ICS) refers to the information system used to monitor and control the industrial processes such as manufacturing, production and distribution. While early ICSs were physically isolated from the outside, today's ICSs have evolved to become integrated with the public Internet. Unfortunately, connecting ICSs to Internet creates a multitude of novel threats and attacks against them, as demonstrated in several recent high-profile incidents around the world. Conventional off-the-shelf IT security solutions are ill-suited for defending against stealthy attacks targeting ICS. To defend against this new threat landscape, novel approaches for attack prevention and detection that are tailored to ICS are necessary. The NeuroPAD project is about process-level anomaly detection in ICS. The hypothesis of the NeuroPAD project is that the physical process controlled by the ICS can be modelled by its inputs and outputs to confirm that the control commands sent to the field devices are executed correctly and that the information coming from sensors is consistent with the expected behavior of the system. It proposes to achieve this goal by developing purely data-driven approaches, in which the dynamics of the physical process are learnt from direct system observations using artificial neural networks. Industrial control systems are vital to the operation of Canada's critical infrastructure. The NeuroPAD project is expected to generate new theoretical insights as well as engineering guidelines to serve as foundation for innovative designs in ICS cybersecurity products. Not only this will lead to economic impact by targeting an expanding market but also societal impact by creating solutions that could be used to protect vital critical infrastructures and industrial processes that impact lives and wellbeing of Canadians across the country.