NeuroPAD: A Neural Process-level Anomaly Detection for Industrial Control Systems

工业控制系统（ICS）是指用于监视和控制制造、生产和分销等工业过程的信息系统。虽然早期的国际信息系统在物理上与外界隔离，但今天的国际信息系统已经发展到与公共互联网集成。不幸的是，将ics连接到Internet会产生许多针对它们的新威胁和攻击，正如最近世界各地发生的几起引人注目的事件所证明的那样。传统的现成IT安全解决方案不适合防御针对ICS的隐形攻击。为了抵御这种新的威胁形势，需要针对ICS量身定制的攻击预防和检测的新方法。NeuroPAD项目是关于ICS中进程级异常检测的。NeuroPAD项目的假设是，ICS控制的物理过程可以通过其输入和输出来建模，以确认发送到现场设备的控制命令被正确执行，并且来自传感器的信息与系统的预期行为一致。它建议通过开发纯粹的数据驱动方法来实现这一目标，其中物理过程的动态是通过使用人工神经网络从直接系统观察中学习的。工业控制系统对加拿大关键基础设施的运行至关重要。NeuroPAD项目有望产生新的理论见解和工程指南，为ICS网络安全产品的创新设计奠定基础。这不仅会通过瞄准不断扩大的市场产生经济影响，还会通过创造可用于保护影响全国加拿大人生活和福祉的重要关键基础设施和工业过程的解决方案产生社会影响。

Industrial control system (ICS) refers to the information system used to monitor and control the industrial processes such as manufacturing, production and distribution. While early ICSs were physically isolated from the outside, today's ICSs have evolved to become integrated with the public Internet. Unfortunately, connecting ICSs to Internet creates a multitude of novel threats and attacks against them, as demonstrated in several recent high-profile incidents around the world. Conventional off-the-shelf IT security solutions are ill-suited for defending against stealthy attacks targeting ICS. To defend against this new threat landscape, novel approaches for attack prevention and detection that are tailored to ICS are necessary.The NeuroPAD project is about process-level anomaly detection in ICS. The hypothesis of the NeuroPAD project is that the physical process controlled by the ICS can be modelled by its inputs and outputs to confirm that the control commands sent to the field devices are executed correctly and that the information coming from sensors is consistent with the expected behavior of the system. It proposes to achieve this goal by developing purely data-driven approaches, in which the dynamics of the physical process are learnt from direct system observations using artificial neural networks. Industrial control systems are vital to the operation of Canada's critical infrastructure. The NeuroPAD project is expected to generate new theoretical insights as well as engineering guidelines to serve as foundation for innovative designs in ICS cybersecurity products. Not only this will lead to economic impact by targeting an expanding market but also societal impact by creating solutions that could be used to protect vital critical infrastructures and industrial processes that impact lives and wellbeing of Canadians across the country.