  Programmable logic controller (PLC) based industrial control systems (ICS)
are used to monitor and control critical infrastructure. Integration of
communication networks and an Internet of Things approach in ICS has increased
ICS vulnerability to cyber-attacks. This work proposes novel unsupervised
machine learning ensemble methods for anomaly detection in PLC-based ICS. The
work presents two broad approaches to anomaly detection: a weighted voting
ensemble approach with a learning algorithm based on coefficient of
determination and a stacking-based ensemble approach using isolation forest
meta-detector. The two ensemble methods were analyzed via an open-source
PLC-based ICS subjected to multiple attack scenarios as a case study. The work
considers four different learning models for the weighted voting ensemble
method. Comparative performance analyses of five ensemble methods driven
diverse base detectors are presented. Results show that stacking-based ensemble
method using isolation forest meta-detector achieves superior performance to
previous work on all performance metrics. Results also suggest that effective
unsupervised ensemble methods, such as stacking-based ensemble having isolation
forest meta-detector, can robustly detect anomalies in arbitrary ICS datasets.
Finally, the presented results were validated by using statistical hypothesis
tests.
