GNN-based Advanced Feature Integration for ICS Anomaly Detection

Abstract

Recent adversaries targeting the Industrial Control Systems (ICSs) have started exploiting their sophisticated inherent contextual semantics such as the data associativity among heterogeneous field devices. In light of the subtlety rendered in these semantics, anomalies triggered by such interactions tend to be extremely covert, hence giving rise to extensive challenges in their detection. Driven by the critical demands of securing ICS processes, a Graph-Neural-Network (GNN) based method is presented to tackle these subtle hostilities by leveraging an ICS's advanced contextual features refined from a universal perspective, rather than exclusively following GNN's conventional local aggregation paradigm. Specifically, we design and implement the Graph Sample-And-Integrate Network (GSIN), a general chained framework performing node-level anomaly detection via advanced feature integration, which combines a node's local awareness with the graph's prominent global properties extracted via process-oriented pooling. The proposed GSIN is evaluated on multiple well-known datasets with different kinds of integration configurations, and results demonstrate its superiority consistently on not only anomaly detection performance (e.g., F1 score and AUPRC) but also runtime efficiency over recent representative baselines.