A Taxonomy of Supervised Learning for IDSs in SCADA Environments

Suaboot, Jakapan; Fahad, Adil; Tari, Zahir; Grundy, John; Mahmood, Abdun Naser; Almalawi, Abdulmohsen; Zomaya, Albert Y.; Drira, Khalil

doi:10.1145/3379499

Cited by 44 publications

(20 citation statements)

References 109 publications

(217 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…. , K { }, and an input feature x, an ideal model M trained for open set recognition should output a label C i for each known class and reject unknown classes as shown by (1). Unknown classes are represented by C u .…”

Section: Overviewmentioning

confidence: 99%

See 1 more Smart Citation

Intrusion Detection for Industrial Control Systems Based on Open Set Artificial Neural Network

Wang

Sun

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

The security of industrial control systems (ICSs) has received a lot of attention in recent years. ICSs were once closed networks. But with the development of IT technologies, ICSs have become connected to the Internet, increasing the potential of cyberattacks. Because ICSs are so tightly linked to human lives, any harm to them could have disastrous implications. As a technique of providing protection, many intrusion detection system (IDS) studies have been conducted. However, because of the complicated network environment and rising means of attack, it is difficult to cover all attack classes, most of the existing classification techniques are hard to deploy in a real environment since they cannot deal with the open set problem. We propose a novel artificial neural network based-methodology to solve this problem. Our suggested method can classify known classes while also detecting unknown classes. We conduct research from two points of view. On the one hand, we use the openmax layer instead of the traditional softmax layer. Openmax overcomes the limitations of softmax, allowing neural networks to detect unknown attack classes. During training, on the other hand, a new loss function termed center loss is implemented to improve detection ability. The neural network model learns better feature representations with the combined supervision of center loss and softmax loss. We evaluate the neural network on NF-BoT-IoT-v2 and Gas Pipeline datasets. The experiments show our proposed method is comparable with the state-of-the-art algorithm in terms of detecting unknown classes. But our method has a better overall classification performance.

show abstract

Section: Overviewmentioning

confidence: 99%

“…Recently, these systems have been connected to the Internet. Although they greatly improve business efficiency, they cause many security issues [1]. e authors of [2] summarized the main attacks on ICSs, among which the most famous one is Stuxnet [3].…”

Section: Introductionmentioning

confidence: 99%

Intrusion Detection for Industrial Control Systems Based on Open Set Artificial Neural Network

Wang

Sun

et al. 2021

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…If IDM recognises the network flow as normal, then ADM undertakes to identify whether an anomaly behaviour is related to this network flow or not. IDM relies on ML supervised detection methods and particularly a decision tree classifier [45]. On the other side, ADM is based on an autoencoder [46,47].…”

Section: Aries Analysis Enginementioning

confidence: 99%

ARIES: A Novel Multivariate Intrusion Detection System for Smart Grid

Radoglou-Grammatikis

Sarigiannidis

Efstathopoulos³

et al. 2020

Sensors

View full text Add to dashboard Cite

The advent of the Smart Grid (SG) raises severe cybersecurity risks that can lead to devastating consequences. In this paper, we present a novel anomaly-based Intrusion Detection System (IDS), called ARIES (smArt gRid Intrusion dEtection System), which is capable of protecting efficiently SG communications. ARIES combines three detection layers that are devoted to recognising possible cyberattacks and anomalies against (a) network flows, (b) Modbus/Transmission Control Protocol (TCP) packets and (c) operational data. Each detection layer relies on a Machine Learning (ML) model trained using data originating from a power plant. In particular, the first layer (network flow-based detection) performs a supervised multiclass classification, recognising Denial of Service (DoS), brute force attacks, port scanning attacks and bots. The second layer (packet-based detection) detects possible anomalies related to the Modbus packets, while the third layer (operational data based detection) monitors and identifies anomalies upon operational data (i.e., time series electricity measurements). By emphasising on the third layer, the ARIES Generative Adversarial Network (ARIES GAN) with novel error minimisation functions was developed, considering mainly the reconstruction difference. Moreover, a novel reformed conditional input was suggested, consisting of random noise and the signal features at any given time instance. Based on the evaluation analysis, the proposed GAN network overcomes the efficacy of conventional ML methods in terms of Accuracy and the F1 score.

show abstract

“…In the recent days, the Supervisory Control and Data Acquisition (SCADA) [1,2] is one of the widely used control systems in the industrial sectors like traffic maintenance, electric power generation, nuclear systems, water/waste water treatment oil mining, and space stations. It is highly important to secure the SCADA systems against the attacking activities of malfunctioning and threatening [3][4][5].…”

Section: Introductionmentioning

confidence: 99%

An Enriched RPCO-BCNN Mechanisms for Attack Detection and Classification in SCADA Systems

Shitharth¹,

Prasad

Sangeetha³

et al. 2021

IEEE Access

View full text Add to dashboard Cite

Providing security to the Supervisory Control and Data Acquisition (SCADA) systems is one of the demanding and crucial tasks in recent days, due to the different types of attacks on the network. For this purpose, there are different types of attack detection and classification methodologies have been developed in the conventional works. But it limits with the issues like high complexity in design, misclassification results, increased error rate, and reduced detection efficiency. In order to solve these issues, this paper aims to develop an advanced machine learning models for improving the SCADA security. This work comprises the stages of preprocessing, clustering, feature selection, and classification. At first, the Markov Chain Clustering (MCC) model is implemented to cluster the network data by normalizing the feature values. Then, the Rapid Probabilistic Correlated Optimization (RPCO) mechanism is employed to select the optimal features by computing the matching score and likelihood of particles. Finally, the Block Correlated Neural Network (BCNN) technique is employed to classify the predicted label, where the relevancy score is computed by using the kernel function with the feature points. During experimentation, there are different performance indicators have been used to validate the results of proposed attack detection mechanisms. Also, the obtained results are compared with the RPCO-BCNN mechanism for proving the superiority of the proposed attack detection system.

show abstract

A Taxonomy of Supervised Learning for IDSs in SCADA Environments

Cited by 44 publications

References 109 publications

Intrusion Detection for Industrial Control Systems Based on Open Set Artificial Neural Network

Intrusion Detection for Industrial Control Systems Based on Open Set Artificial Neural Network

ARIES: A Novel Multivariate Intrusion Detection System for Smart Grid

An Enriched RPCO-BCNN Mechanisms for Attack Detection and Classification in SCADA Systems

Contact Info

Product

Resources

About