Anomaly detection in industrial control systems using evolutionary-based optimization of neural networks

Abstract

Industrial control systems are increasingly used for control and monitoring of important infrastructure. Machine learning algorithms have the ability to discover patterns in large amounts of data and to create diagnosis models based on these patterns. Since modelling a large amount of unlabeled data is costly and time-consuming, the automated machine learning methods have the ability to detect anomalies in industrial control systems effectively. In this paper, first, twenty-four machine learning algorithms are evaluated for anomaly detection in gas distribution control network. Then dimensionality reduction algorithms are used to improve the accuracy of anomaly detection. Finally, by using an evolutionary based optimization for training a neural network, a new algorithm for prediction of anomalies in the SCADA system with high accuracy is proposed. The experimental results show that the proposed algorithm has the ability to detect the anomalies in the gas distribution control network with 97.5% accuracy.

A Review of Machine Learning Approaches to Power System Security and Stability

“…Even though communication between SCADA components can be performed by different network protocols, the most widely deployed in the literature is the MODBUS over TCP/IP [3], [28], [45]. However, due to the unavailability of real-time SCADA dataset, researchers make use of publicly available datasets such as the simulated Mississippi State University (MSU) SCADA laboratory gas pipeline dataset [28], [73], [74] and KDD99 dataset [75]. Other notable public dataset include the cybergym dataset [3], UC Irvine machine learning repository dataset [73] [3], [33], [46].…”

“…However, due to the unavailability of real-time SCADA dataset, researchers make use of publicly available datasets such as the simulated Mississippi State University (MSU) SCADA laboratory gas pipeline dataset [28], [73], [74] and KDD99 dataset [75]. Other notable public dataset include the cybergym dataset [3], UC Irvine machine learning repository dataset [73] [3], [33], [46]. Sufficient network traffic that contains both normal traffic and the abnormal traffic (due to the intrusion) are captured as dataset for data preprocessing.…”

A Review of Research Works on Supervised Learning Algorithms for SCADA Intrusion Detection and Classification

“…Waghmare et al [73] deployed principal component analysis (PCA) for feature reduction for a SCADA dataset. The authors in [74] used PCA, generalized hebbian algorithm, independent component analysis (ICA), singular value decomposition and self-organizing map as feature reduction tool in their SCADA security study. The authors in [75] also used PCA, ICA and canonical correlation analysis for a similar task.…”

Autoencoder Based Anomaly Detection for SCADA Networks

“…Gas Pipeline MLP with GWO (Mansouri, et al, 2017) Gas Pipeline K-means, Naïve Bayesian, PCA-SVD, GMM (Shirazi et al, 2016) Gas pipeline LSTM (Feng et al, 2017) Water Distribution System (DUWWTP) KNN, K-means (Almalawi, et al, 2014) DUWWTP, Gas pipeline SVDD, PCA (Nader et al, 2014) Network trace OCSVM, K-means (Maglaras, & Jiang, 2014) CERT Insider Threat RNN (Tuor et al, 2017) algorithms is provided (Mansouri, et. al., 2017) for anomaly detection in a gas distribution network (Beaver, et al, 2013) and dimensionality reduction techniques for improving accuracy were also used.…”

“…(Shirazi et al, 2016) provide results of four techniques (K-means, PCA-SVDD, NB, GMM of which the best results are represented for each category in Table 5. Mansouri, et al (2017) used a set of 24 techniques on the dataset and reported an accuracy of 97.5% for their proposed system based on a Gray Wolf Optimizer (GWO) algorithm.…”