A Multi-Model-based Approach to Detect Cyber Stealth Attacks in Industrial Internet of Things.

The Industrial Internet of Things (IIoT) combines industrial systems, the Internet of Things (IoT), and Cloud Computing. Consequently, IIoT enables a more agile and efficient automation, control and orchestration of future industrial systems, while improving the energy efficiency in smart factories. Unfortunately, while the benefits of IIoT are undeniable, their pervasive adoption as key enablers for future industries also paved the way for new security risks. As a response to newly emerging threats and disruptive cyber attacks, this paper documents a methodology for detecting cyber stealth attacks against IIoT. Cyber stealth attacks denote the ability of the attacker to remain in a stealth state (i.e., not to be detected) during the execution of a cyber attack. The developed methodology leverages a two-tiered approach, where the first tier uses individual anomaly detection engines implemented with the help of artificial neural networks, while the second tier adopts Dempster-Shafer's “Theory of Evidence” in order to aggregate the evidence from a distributed set of detection engines. Experimental results against a continuous stirred-tank reactor (CSTR) model demonstrate the applicability to IIoT.