mkravchik / practical-poisoning-ics-ad

practical-poisoning-ics-ad

Official implementation of "Practical Evaluation of Poisoning Attacks on Online Anomaly Detectors in Industrial Control Systems".

UNDER CONSTRUCTION: the code is working, but is gearded towards experimenting, its external API is not user friendly yet

Requirements

• Python 3.6
• tensorflow==1.15
• keras==2.3.1
• munch==2.5.0
• numpy==1.19.2
• scikit-learn==0.23.1
• scipy==1.5.2
• matplotlib==3.3.4
• pandas==1.1.2
• tqdm==4.48.2
• seaborn==0.10.1

For running the SWaT tests the code is expecting to have the dataset that can be requested at https://itrust.sutd.edu.sg/itrust-labs_datasets/. The dataset train and test files should be subsampled at the 5 seconds rate and saved locally in the files named SWaT_Dataset_Normal_sub5.csv and SWaT_Dataset_Attack_sub5.csv, correspondingly.

For running the Tennessee Eastman experiments, it is necessary to install Matlab/Simulink and get as a base for the experiments the TE model from the Revision of the Tennessee Eastman Process Model paper. The link to the files is inside the paper. The TE model should be extracted into the temexd_mod directory. The files in this repository residing in the temexd_mod will work on the top of the original model.

Data and Results for Section 5

The TE experiments involve a number of files generated by each stage of the 5-phase process described in Section 5.4. TE Simulator Poisoning Setup. The files for each attack in the paper along with the results of each poisoning attack can be found here. Please refer to readme.txt for the detailed explanations of each file.

The TE anomaly detector needs data files for training. The files (TE_train.csv and TE_train_for_attack%d.csv) can be found at the link above.

Usage

UNDER CONSTRUCTION: the code is working, but is gearded towards experimenting, its external API is not user friendly yet. In the meantime, you can edit the Poisoning.py to call the test configuration you are interested in. The possibilities are: synthetic_test, syn_swat_test, swat_test, te_test. Inside each test, a conf dictionary contains a multitude of parameters you can experiment with.

python Poisoning.py 

The file matlab_log_parsing.py contains helper functions for TE process experiments.

Parameters (in the alphabetic order)

UNDER CONSTRUCTION