Detection of internal security incidents in cyberphysical systems

Financial University under the Government of the Russian Federation, 49, Leningradskiy ave. Moscow, 125993, Russia

^* Corresponding author: shumskaya.ao@gmail.com

Abstract

This paper addresses the issue of internal security breaches in cyber-physical systems framing it as an anomaly detection problem within the framework of machine learning models. The use of powerful mathematical apparatus embedded in the structure of machine learning models, including models based on artificial neural networks, allows building an autonomous system for detecting internal security breaches with minimal reliance on expert assessments. The determination of user abnormality is made on the basis of average data on log entries of actions in the system identified as abnormal, as well as on statistical data on the number of such entries for each user. The results presented here demonstrate the successful application of these models to the task of identifying insider threats to system access subjects.