Multivariate Industrial Time Series with Cyber-Attack Simulation: Fault Detection Using an LSTM-based Predictive Data Model

Abstract: We adopted an approach based on an LSTM neural network to monitor and detect faults in industrial multivariate time series data. To validate the approach we created a Modelica model of part of a real gasoil plant. By introducing hacks into the logic of the Modelica model, we were able to generate both the roots and causes of fault behavior in the plant. Having a self-consistent data set with labeled faults, we used an LSTM architecture with a forecasting error threshold to obtain precision and recall quality metrics. The dependency of the quality metric on the threshold level is considered. An appropriate mechanism such as "one handle" was introduced for filtering faults that are outside of the plant operator field of interest.

LSTM-based Fault Detection in Multivariate Industrial Time Series with Cyber-Attack Simulation

The paper "Multivariate Industrial Time Series with Cyber-Attack Simulation: Fault Detection Using an LSTM-based Predictive Data Model" by Pavel Filonov, Andrey Lavrentyev, and Artem Vorontsov, presents an in-depth exploration of utilizing Long Short-Term Memory (LSTM) neural networks for fault detection in industrial systems. This research aligns with the burgeoning focus on cybersecurity and fault diagnosis within Industry 4.0 and IoT-integrated cyber-physical systems (CPS).

The authors have constructed a Modelica simulation model of a gasoil heating loop (GHL) to generate a thorough and reliable dataset consisting of normal and anomalous behavioral indices. By simulating cyber-attacks—in particular, unauthorized changes to RT level set points—this study introduces variability in the data, enabling the LSTM model to correctly discern and forecast anomalous patterns.

Crucially, the model data spans 19 variables derived from the GHL, although the same methodology is applicable to a full set of 270 variables. Under experimentation, the LSTM architecture, including a sequence-to-sequence learning mechanism and dropout regularization, was tuned using the RMSprop optimization algorithm, yielding appreciable precision and recall metrics. The detection mechanism centers around monitoring the mean squared error (MSE) between predicted and actual values, classifying instances as normal or faulty based on their deviation beyond a dynamically computed threshold.

The results exhibit a strong performance, where LSTM achieved a precision of 0.976 and a recall of 0.788, with an F1 score of 0.872. These outcomes signify a favorable comparison with conventional methods such as PCA, FDA, and PLS, underscoring the LSTM’s capability in maintaining balanced precision-recall metrics. Importantly, the adaptable threshold parameter offers users control over false-positive rates, providing a flexible tool for industrial fault monitoring systems.

From a theoretical standpoint, this paper contributes to the understanding of how LSTM models can effectively handle non-linear, non-stationary multivariate time series typical in industrial settings. The authors highlight the need for future work to address binary decision-making, the integration of an abnormality measure for prioritizing alerts, and developing fault diagnosis capabilities. Moreover, they suggest enhancements to the GHL model to incorporate stochastic elements and measurement noise, thus refining the applicability and robustness of their model in real-world scenarios.

Overall, this research provides a comprehensive baseline in employing advanced neural architectures such as LSTMs for industrial fault detection, underlining their relevance and potential in enhancing cyber-physical system resilience. The findings and methodological approaches detailed herein pave the way for further advancements in industrial anomaly detection, potentially transforming operational monitoring techniques in the industry.