Prediction of Industrial Cyber Attacks Using Normalizing Flows

Doklady Mathematics. 2024. Vol. 110. No. 1. P. S95–S102.

V.P. Stepashkina, M.I. Hushchyn

This paper presents the development and evaluation of methods for detecting cyberattacks on industrial systems using neural network approaches. The focus is on the task of detecting anomalies in multivariate time series, where the diversity and complexity of potential attack scenarios require the use of advanced models. To address these challenges, a transformer-based autoencoder architecture was used, which was further enhanced by transitioning to a variational autoencoder (VAE) and integrating normalizing flows. These modifications allowed the model to better capture the data distribution, enabling effective anomaly detection, including those not present in the training set. As a result, high performance was achieved, with an F1 score of 0.93 and a ROC-AUC of 0.87. The results underscore the effectiveness of the proposed methodology and provide valuable contributions to the field of anomaly detection and cybersecurity in industrial systems.

Ключевые слова: временные ряды, artifitial neural networks, anomaly detection, глубинные нейронные сети, multivariate time series, детектирование аномалий

ПУБЛИКАЦИЯ ПОДГОТОВЛЕНА ПО РЕЗУЛЬТАТАМ ПРОЕКТА: Повышение эффективности центров обработки данных и систем хранения данных методами искусственного интеллекта (2027)