Due to the rise of Industrial Control Systems (ICSs) cyber-attacks in the
recent decade, various security frameworks have been designed for anomaly
detection. While advanced ICS attacks use sequential phases to launch their
final attacks, existing anomaly detection methods can only monitor a single
source of data. Therefore, analysis of multiple security data can provide
comprehensive and system-wide anomaly detection in industrial networks. In this
paper, we propose an anomaly detection framework for ICSs that consists of two
stages: i) blockchain-based log management where the logs of ICS devices are
collected in a secure and distributed manner, and ii) multi-source anomaly
detection where the blockchain logs are analysed using multi-source deep
learning which in turn provides a system wide anomaly detection method.
We validated our framework using two ICS datasets: a factory automation
dataset and a Secure Water Treatment (SWAT) dataset. These datasets contain
physical and network level normal and abnormal traffic. The performance of our
new framework is compared with single-source machine learning methods. The
precision of our framework is 95% which is comparable with single-source
anomaly detectors.