Edinburgh Napier University

  Industrial Control Systems (ICS) are hardware, network, and software, upon which a facility depends to allow daily operations to function. In most cases society takes the operation of such systems, for example public transport, tap water or electricity, for granted. However, the disruption of those systems might have serious consequences across different sectors. In this paper, we propose a supervised energy-based approach for anomaly detection in a clean water supply system using a new dataset which is physically modelled in the Festo MPA workstation rig. The novelty relies on the set of engineered features collected from the testbed, including voltage, current and power from the sensors that compose the ICS. These values are obtained from independent current sensors that we have physically wired to the testbed. Five machine learning algorithms; Support Vector Machine, k-Nearest Neighbours, Multilayer Perceptron, Decision Tree and Random Forest are employed to evaluate the effectiveness of our proposed features. The metrics used to present the performance of the selected machine learning algorithms are F1-Score, G-Mean, False Positive Rate (FPR) and False Negative Rate (FNR). The results show that machine learning algorithms can classify the variations of energy produced by the execution of cyber-attacks as anomalous by achieving 95.5% F1-Score, and 6.8% FNR with the Multilayer Perceptron classifier.