Abstract
Detection of cyber-physical attacks typically relies on maintaining a list of known exploits, and examining real time data for evidence of those exploits. However, this is often cost prohibitive, and still remains vulnerable to zero-day attacks. Thus, development of models that can accurately detect attacks without a priori knowledge of what those attacks look like is an important research question. Here we examine a common semi-supervised learning method, and discuss techniques for refining its application to intrusion detection in industrial control systems (ICS) data. Principal component analysis (PCA) has been shown to be effective in this endeavor, although problems can arise in implementation. We discuss a collection of techniques for improving this method. The techniques are applied to the Hardware-in-the-Loop-Based Augmented Industrial Control System (HAI) dataset, and the results compared.