# A Variational Autoencoder Framework for Robust, Physics-Informed Cyberattack Recognition in Industrial Cyber-Physical Systems

arXiv: https://arxiv.org/abs/2310.06948 · HTML: https://mlsanity.com/paper/2310.06948/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 37 references that are in the map.
- First posted on arXiv 10 Oct 2023.

## Builds on (most cited first, 6 of 6)

- [Deep State Space Models for Nonlinear System Identification](https://mlsanity.com/paper/2003.14162/) (2020)
- [Covert Attacks in Cyber-Physical Control Systems](https://mlsanity.com/paper/1609.09537/) (2016)
- [An Online Detection Framework for Cyber Attacks on Automatic Generation Control](https://mlsanity.com/paper/1712.06417/) (2017)
- [An Ensemble Deep Learning-based Cyber-Attack Detection in Industrial Control System](https://mlsanity.com/paper/2005.00936/) (2020)
- [An Online Approach to Cyberattack Detection and Localization in Smart Grid](https://mlsanity.com/paper/2102.11401/) (2021)
- [Deep Learning based Covert Attack Identification for Industrial Control Systems](https://mlsanity.com/paper/2009.12360/) (2020)

## Built on by (most cited first, 1 of 1)

- [Physics-Informed Convolutional Autoencoder for Cyber Anomaly Detection in Power Distribution Grids](https://mlsanity.com/paper/2312.04758/) (2023)

## Abstract (arXiv)

Cybersecurity of Industrial Cyber-Physical Systems is drawing significant concerns as data communication increasingly leverages wireless networks. A lot of data-driven methods were develope for detecting cyberattacks, but few are focused on distinguishing them from equipment faults. In this paper, we develop a data-driven framework that can be used to detect, diagnose, and localize a type of cyberattack called covert attacks on networked industrial control systems. The framework has a hybrid design that combines a variational autoencoder (VAE), a recurrent neural network (RNN), and a Deep Neural Network (DNN). This data-driven framework considers the temporal behavior of a generic physical system that extracts features from the time series of the sensor measurements that can be used for detecting covert attacks, distinguishing them from equipment faults, as well as localize the attack/fault. We evaluate the performance of the proposed method through a realistic simulation study on a networked power transmission system as a typical example of ICS. We compare the performance of the proposed method with the traditional model-based method to show its applicability and efficacy.