Title: On the Feasibility of Distinguishing Between Process Disturbances and Intrusions in Process Control Systems Using Multivariate Statistical Process Control,
Abstract: Process Control Systems (PCSs) are the operating core of Critical
Infrastructures (CIs). As such, anomaly detection has been an active research
field to ensure CI normal operation. Previous approaches have leveraged network
level data for anomaly detection, or have disregarded the existence of process
disturbances, thus opening the possibility of mislabelling disturbances as
attacks and vice versa. In this paper we present an anomaly detection and
diagnostic system based on Multivariate Statistical Process Control (MSPC),
that aims to distinguish between attacks and disturbances. For this end, we
expand traditional MSPC to monitor process level and controller level data. We
evaluate our approach using the Tennessee-Eastman process. Results show that
our approach can be used to distinguish disturbances from intrusions to a
certain extent and we conclude that the proposed approach can be extended with
other sources of data for improving results.