Inter-Domain Fusion for Enhanced Intrusion Detection in Power Systems: An Evidence Theoretic and Meta-Heuristic Approach

Abstract

False alerts due to misconfigured or compromised intrusion detection systems (IDS) in industrial control system (ICS) networks can lead to severe economic and operational damage. However, research using deep learning to reduce false alerts often requires the physical and cyber sensor data to be trustworthy. Implicit trust is a major problem for artificial intelligence or machine learning (AI/ML) in cyber-physical system (CPS) security, because when these solutions are most urgently needed is also when they are most at risk (e.g., during an attack). To address this, the Inter-Domain Evidence theoretic Approach for Inference (IDEA-I) is proposed that reframes the detection problem as how to make good decisions given uncertainty. Specifically, an evidence theoretic approach leveraging Dempster–Shafer (DS) combination rules and their variants is proposed for reducing false alerts. A multi-hypothesis mass function model is designed that leverages probability scores obtained from supervised-learning classifiers. Using this model, a location-cum-domain-based fusion framework is proposed to evaluate the detector’s performance using disjunctive, conjunctive, and cautious conjunctive rules. The approach is demonstrated in a cyber-physical power system testbed, and the classifiers are trained with datasets from Man-In-The-Middle attack emulation in a large-scale synthetic electric grid. For evaluating the performance, we consider plausibility, belief, pignistic, and general Bayesian theorem-based metrics as decision functions. To improve the performance, a multi-objective-based genetic algorithm is proposed for feature selection considering the decision metrics as the fitness function. Finally, we present a software application to evaluate the DS fusion approaches with different parameters and architectures.

Design of Next-Generation Cyber-Physical Energy Management Systems: Monitoring to Mitigation

“…CYPRES EMS also leverages custom logic in IEC 61131 in the SEL Real Time Automation Controller (RTAC) device to detect and respond [25] and incorporates multi-domain multi-sensor cyber-physical data fusion for intrusion detection [26]. To address uncertainty in alerts from the sensors, CYPRES EMS also provides a framework for evidence-theoretic rules of combination [27]. It is important to note that CYPRES EMS works well with and complements existing efforts.…”

“…• Dempster Shafer-based Fusion IDS: In [27], this IDS is proposed to address uncertainty in alerts to reduce false alert rates. A location-cum-domain based fusion framework is proposed and evaluated with different combination rules, that fuse multiple evidence from inter-domain and intra-domain sensors.…”

Inferring adversarial behaviour in cyber‐physical power systems using a Bayesian attack graph approach

“…Hence, other works, for example, Ref. [7], that address aleatory uncertainty through the notion of ignorance (analogous to the impact of a zero-day exploit on the symptoms of an intrusion), can be considered. Further, alerts generated from IDS can act as a data source for the structure learning problem to learn the structure of an attack graph based on the prior structure provided by experts [10].…”

“…Every time a new evidence is obtained, the BAG is dynamically updated, as in Figure 7. Updating the posterior based on multiple evidences is similar to our prior work on multi-sensor fusion work [7] based on DSTE and its rules of combination.…”

“…Among these, Bayesian Networks (BNs) are adopted in this work for four major reasons: The BN formalism is versatile and allows ease of construction from many sources, for example, cybersecurity domain experts' prior knowledge, different threat models and by learning from raw data. By comparison, the Inter‐Domain Evidence theoretic Approach for Inference (IDEA‐I) based on Dempster Shafer Theory of Evidence (DSTE) [7] is shown to assist in reducing false alarms, but has challenges with incorporating domain knowledge, high computational expense and inability to capture causal relationships between events. Compared to DSTE, BNs are advantageous for incorporating prior model information in the defense of power systems. BNs are probabilistic graphical models (PGMs) that help account for uncertainty of an adversary's behaviour.…”