Novelty detection and management to safeguard information-intensive critical infrastructures

When the complexity of a system increases, the number of possible faults and anomalous working conditions becomes very high; on the contrary, the number of 'normal' behaviours is generally low and often well determined by rules and constraints defined by the characteristics of the furnished services. In this paper, after a general overview of the SAFEGUARD system, a more detailed description of the agents, dedicated to early detection of anomalies and failures inside a Supervisory and Control and Data Acquisition (SCADA) system of an electricity transmission network is given. The paper also describes how it is possible to correlate the detected novelty events and to decide the right recovery policies avoiding inappropriate reactions caused by false alarms. A test benchmark of the novelty detection agents will be executed inside a simulated SCADA electricity transmission system and the layout of the utilised testing environment is described in the paper.