Improving SIEM for critical SCADA water infrastructures using machine learning

Network Control Systems (NAC) have been used in many industrial processes. They aim to reduce the human factor burden and efficiently handle the complex process and communication of those systems. Supervisory control and data acquisition (SCADA) systems are used in industrial, infrastructure and facility processes (e.g. manufacturing, fabrication, oil and water pipelines, building ventilation, etc.) Like other Internet of Things (IoT) implementations, SCADA systems are vulnerable to cyber-attacks, therefore, a robust anomaly detection is a major requirement. However, having an accurate anomaly detection system is not an easy task, due to the difficulty to differentiate between cyber-attacks and system internal failures (e.g. hardware failures). In this paper, we present a model that detects anomaly events in a water system controlled by SCADA. Six Machine Learning techniques have been used in building and evaluating the model. The model classifies different anomaly events including hardware failures (e.g. sensor failures), sabotage and cyber-attacks (e.g. DoS and Spoofing). Unlike other detection systems, our proposed work helps in accelerating the mitigation process by notifying the operator with additional information when an anomaly occurs. This additional information includes the probability and confidence level of event(s) occurring. The model is trained and tested using a real-world dataset

A Review of Prognostics and Health Management Applications in Nuclear Power Plants

The US operating fleet of light water reactors (LWRs) is currently undergoing life extensions from the original 40-year license to 60 years of operation. In the US, 74 reactors have been approved for the first round license extension, and 19 additional applications are currently under review. Safe and economic operation of these plants beyond 60 years is now being considered in anticipation of a second round of license extensions to 80 years of operation.Greater situational awareness of key systems, structures, and components (SSCs) can provide the technical basis for extending the life of SSCs beyond the original design life and supports improvements in both safety and economics by supporting optimized maintenance planning and power uprates. These issues are not specific to the aging LWRs; future reactors (including Generation III+ LWRs, advanced reactors, small modular reactors, and fast reactors) can benefit from the same situational awareness. In fact, many SMR and advanced reactor designs have increased operating cycles (typically four years up to forty years), which reduce the opportunities for inspection and maintenance at frequent, scheduled outages. Understanding of the current condition of key equipment and the expected evolution of degradation during the next operating cycle allows for targeted inspection and maintenance activities. This article reviews the state of the art and the state of practice of prognostics and health management (PHM) for nuclear power systems. Key research needs and technical gaps are highlighted that must be addressed in order to fully realize the benefits of PHM in nuclear facilities

A hybrid one-class approach for detecting anomalies in industrial systems

Financiado para publicación en aberto: Universidade da Coruña/CISUG[Abstract]: The significant advance of Internet of Things in industrial environments has provided the possibility of monitoring the different variables that come into play in an industrial process. This circumstance allows the supervision of the current state of an industrial plant and the consequent decision making possibilities. Then, the use of anomaly detection techniques are presented as a powerful tool to determine unexpected situations. The present research is based on the implementation of one-class classifiers to detect anomalies in two industrial systems. The proposal is validated using two real datasets registered during different operating points of two industrial plants. To ensure a better performance, a clustering process is developed prior the classifier implementation. Then, local classifiers are trained over each cluster, leading to successful results when they are tested with both real and artificial anomalies. Validation results present in all cases, AUC values above 90%.Xunta de Galicia. Consellería de Educación, Universidade e Formación Profesional; ED431G 2019/0

DEVELOPMENT OF INSTRUMENTATION AND CONTROL SYSTEMS FOR AN INTEGRAL LARGE SCALE PRESSURIZED WATER REACTOR

Small and large scale integral light water reactors are being developed to supply electrical power and to meet the needs of process heat, primarily for water desalination. This dissertation research focuses on the instrumentation and control of a large integral inherently safe light water reactor (designated as I2S-LWR) which is being designed as part of a grant by the U.S. Department of Energy Integrated Research Project (IRP). This 969 MWe integral pressurized water reactor (PWR) incorporates as many passive safety features as possible while maintaining competitive costs with current light water reactors. In support of this work, the University of Tennessee has been engaged in research to solve the instrumentation and control challenges posed by such a reactor design. This dissertation is a contribution to this effort. The objectives of this dissertation are to establish the feasibility and conceptual development of instrumentation strategies and control approaches for the I2S-LWR, with consideration to the state of the art of the field. The objectives of this work are accomplished by the completion of the following tasks: Assessment of instrumentation needs and technology gaps associated with the instrumentation of the I2S-LWR for process monitoring and control purposes. Development of dynamic models of a large integral PWR core, micro-channel heat exchangers (MCHX) that are contained within the reactor pressure vessel, and steam flashing drums located external to the containment building. Development and demonstration of control strategies for reactor power regulation, steam flashing drum pressure regulation, and flashing drum water level regulation for steady state and load-following conditions. Simulation, detection, and diagnosis of process anomalies in the I2S-LWR model. This dissertation is innovative and significant in that it reports the first instrumentation and control study of nuclear steam supply by integral pressurized water reactor coupled to an isenthalpic expansion vessel for steam generation. Further, this dissertation addresses the instrumentation and control challenges associated with integral reactors, as well as improvements to inherent safety possible in the instrumentation and control design of integral reactors. The results of analysis and simulation demonstrate the successful development of dynamic modeling, control strategies, and instrumentation for a large integral PWR

Structural Health Monitoring of Pipelines in Radioactive Environments Through Acoustic Sensing and Machine Learning

Structural health monitoring (SHM) comprises multiple methodologies for the detection and characterization of stress, damage, and aberrations in engineering structures and equipment. Although, standard commercial engineering operations may freely adopt new technology into everyday operations, the nuclear industry is slowed down by tight governmental regulations and extremely harsh environments. This work aims to investigate and evaluate different sensor systems for real-time structural health monitoring of piping systems and develop a novel machine learning model to detect anomalies from the sensor data. The novelty of the current work lies in the development of an LSTM-autoencoder neural network to automate anomaly detection on pipelines based on a fiber optic acoustic transducer sensor system. Results show that pipeline events and faults can be detected by the MLM developed, with a high degree of accuracy and low rate of false positives even in a noisy environment near pumps and machinery

Predictive Maintenance Support System in Industry 4.0 Scenario

The fourth industrial revolution that is being witnessed nowadays, also known as Industry 4.0, is heavily related to the digitization of manufacturing systems and the integration of different technologies to optimize manufacturing. By combining data acquisition using specific sensors and machine learning algorithms to analyze this data and predict a failure before it happens, Predictive Maintenance is a critical tool to implement towards reducing downtime due to unpredicted stoppages caused by malfunctions. Based on the reality of Commercial Specialty Tires factory at Continental Mabor - Indústria de Pneus, S.A., the present work describes several problems faced regarding equipment maintenance. Taking advantage of the information gathered from studying the processes incorporated in the factory, it is designed a solution model for applying predictive maintenance in these processes. The model is divided into two primary layers, hardware, and software. Concerning hardware, sensors and respective applications are delineated. In terms of software, techniques of data analysis namely machine learning algorithms are described so that the collected data is studied to detect possible failures

Intrusion Detection for Cyber-Physical Attacks in Cyber-Manufacturing System

In the vision of Cyber-Manufacturing System (CMS) , the physical components such as products, machines, and tools are connected, identifiable and can communicate via the industrial network and the Internet. This integration of connectivity enables manufacturing systems access to computational resources, such as cloud computing, digital twin, and blockchain. The connected manufacturing systems are expected to be more efficient, sustainable and cost-effective. However, the extensive connectivity also increases the vulnerability of physical components. The attack surface of a connected manufacturing environment is greatly enlarged. Machines, products and tools could be targeted by cyber-physical attacks via the network. Among many emerging security concerns, this research focuses on the intrusion detection of cyber-physical attacks. The Intrusion Detection System (IDS) is used to monitor cyber-attacks in the computer security domain. For cyber-physical attacks, however, there is limited work. Currently, the IDS cannot effectively address cyber-physical attacks in manufacturing system: (i) the IDS takes time to reveal true alarms, sometimes over months; (ii) manufacturing production life-cycle is shorter than the detection period, which can cause physical consequences such as defective products and equipment damage; (iii) the increasing complexity of network will also make the detection period even longer. This gap leaves the cyber-physical attacks in manufacturing to cause issues like over-wearing, breakage, defects or any other changes that the original design didn’t intend. A review on the history of cyber-physical attacks, and available detection methods are presented. The detection methods are reviewed in terms of intrusion detection algorithms, and alert correlation methods. The attacks are further broken down into a taxonomy covering four dimensions with over thirty attack scenarios to comprehensively study and simulate cyber-physical attacks. A new intrusion detection and correlation method was proposed to address the cyber-physical attacks in CMS. The detection method incorporates IDS software in cyber domain and machine learning analysis in physical domain. The correlation relies on a new similarity-based cyber-physical alert correlation method. Four experimental case studies were used to validate the proposed method. Each case study focused on different aspects of correlation method performance. The experiments were conducted on a security-oriented manufacturing testbed established for this research at Syracuse University. The results showed the proposed intrusion detection and alert correlation method can effectively disclose unknown attack, known attack and attack interference that causes false alarms. In case study one, the alarm reduction rate reached 99.1%, with improvement of detection accuracy from 49.6% to 100%. The case studies also proved the proposed method can mitigate false alarms, detect attacks on multiple machines, and attacks from the supply chain. This work contributes to the security domain in cyber-physical manufacturing systems, with the focus on intrusion detection. The dataset collected during the experiments has been shared with the research community. The alert correlation methodology also contributes to cyber-physical systems, such as smart grid and connected vehicles, which requires enhanced security protection in today’s connected world

An architecture to predict anomalies in industrial processes

Dissertation presented as the partial requirement for obtaining a Master's degree in Data Science and Advanced Analytics, specialization in Data ScienceThe Internet of Things (IoT) and machine learning algorithms (ML) are enabling a revolutionary change in digitization in numerous areas, benefiting Industry 4.0 in particular. Predictive maintenance using machine learning models is being used to protect assets in industry. In this paper, an architecture for predicting anomalies in industrial processes was proposed in which SMEs can be guided in implementing an IIoT architecture for predictive maintenance (PdM). This research was conducted to understand what machine learning architectures and models are generally used by industry for PdM. An overview of the concepts of the Industrial Internet of Things (IIoT), machine learning (ML), and predictive maintenance (PdM) was provided, and through a systematic literature review, it was possible to understand their applications and which technologies enable their use. The survey revealed that PdM applications are increasingly common and that there are many studies on the development of new ML techniques. The survey conducted confirmed the usefulness of the artifact and showed the need for an architecture to guide the implementation of PdM. This research can be a contribution for SMEs, allowing them to become more efficient and reduce both production and maintenance costs in order to keep up with multinational companies