Anomaly detection method based on penalty least squares algorithm and time window entropy for Cyber–Physical Systems

Abstract

Real-time system status detection must be accurate and reliable due to the close coupling of Cyber-Physical Systems (CPS) components. In order to improve the effectiveness of the CPS anomaly detection method, this paper proposes a real-time detection method based on the least squares algorithm and conditional entropy. To address the issue of overfitting and insufficient generalization of least squares, the penalty term of least squares is optimized by two different functions. Meanwhile, the K-S test is introduced in the time window entropy detection model to tackle the problem of setting threshold. The two detection mechanisms proposed operate in parallel and the initial localization of anomaly source is achieved by the time window entropy mechanism. The proposed method for anomaly detection is assessed using six evaluation metrics and demonstrates an accurate and effective detection capability on both the SWaT dataset and the CICIDS2017 dataset.