Developing a Strong CPS Defender: An Evolutionary Approach

TL;DR

This paper introduces Evo-Defender, an evolutionary framework for CPS security that enhances attack detection by actively challenging attackers through iterative attacker-defender interactions, leading to improved generalization and efficiency.

Contribution

It presents a novel evolutionary approach combining guided fuzzing and incremental learning to strengthen CPS defenses against unseen attacks.

Findings

Evo-Defender outperforms state-of-the-art baselines by up to 2.7% in detection performance.

It efficiently utilizes training data for faster, more robust attack detection.

Implemented on realistic CPS testbeds with over 600 attack scenarios.

Abstract

Cyber-physical systems (CPSs) are used extensively in critical infrastructure, underscoring the need for anomaly detection systems that are able to catch even the most motivated attackers. Traditional anomaly detection techniques typically do `one-off' training on datasets crafted by experts or generated by fuzzers, potentially limiting their ability to generalize to unseen and more subtle attack strategies. Stopping at this point misses a key opportunity: a defender can actively challenge the attacker to find more nuanced attacks, which in turn can lead to more effective detection capabilities. Building on this concept, we propose Evo-Defender, an evolutionary framework that iteratively strengthens CPS defenses through a dynamic attacker-defender interaction. Evo-Defender includes a smart attacker that employs guided fuzzing to explore diverse, non-redundant attack strategies, while the self-evolving defender uses incremental learning to adapt to new attack patterns. We implement Evo-Defender on two realistic CPS testbeds: the Tennessee Eastman process and a Robotic Arm Assembly Workstation, injecting over 600 attack scenarios. In end-to-end attack detection experiments, Evo-Defender achieves up to 2.7% higher performance than state-of-the-art baselines on unseen scenarios, while utilizing training data more efficiently for faster and more robust detection.