Intrusion detection system for SCADA platforms through machine learning algorithms

Prisco, Andres Felipe Sanchez; Duitama, M. John Freddy

doi:10.1109/colcomcon.2017.8088210

Cited by 8 publications

(7 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Maglaras et al [35] modeled a OCSVM model for detecting cyberintrusions in a designed small SCADA testbed. Prisco and Duitama [95] also proposed OCSVM for detecting intrusions on SCADA network. In a related work, Fang et al [96] modelled a support vector regression for predicting a SCADA monitoring data.…”

Section: Support Vector Machine (Svm)mentioning

confidence: 99%

A Review of Research Works on Supervised Learning Algorithms for SCADA Intrusion Detection and Classification

et al. 2021

View full text Add to dashboard Cite

Supervisory Control and Data Acquisition (SCADA) systems play a significant role in providing remote access, monitoring and control of critical infrastructures (CIs) which includes electrical power systems, water distribution systems, nuclear power plants, etc. The growing interconnectivity, standardization of communication protocols and remote accessibility of modern SCADA systems have contributed massively to the exposure of SCADA systems and CIs to various forms of security challenges. Any form of intrusive action on the SCADA modules and communication networks can create devastating consequences on nations due to their strategic importance to CIs’ operations. Therefore, the prompt and efficient detection and classification of SCADA systems intrusions hold great importance for national CIs operational stability. Due to their well-recognized and documented efficiencies, several literature works have proposed numerous supervised learning techniques for SCADA intrusion detection and classification (IDC). This paper presents a critical review of recent studies whereby supervised learning techniques were modelled for SCADA intrusion solutions. The paper aims to contribute to the state-of-the-art, recognize critical open issues and offer ideas for future studies. The intention is to provide a research-based resource for researchers working on industrial control systems security. The analysis and comparison of different supervised learning techniques for SCADA IDC systems were critically reviewed, in terms of the methodologies, datasets and testbeds used, feature engineering and optimization mechanisms and classification procedures. Finally, we briefly summarized some suggestions and recommendations for future research works.

show abstract

Section: Support Vector Machine (Svm)mentioning

confidence: 99%

A Review of Research Works on Supervised Learning Algorithms for SCADA Intrusion Detection and Classification

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Both [42] and [43] presented an IDS that detects malicious network traffic in SCADA systems, based on One Class Support Vector Machine (OCSVM) technique. While authors of [42] use OCSVM to classify malicious observations by comparing them with benign ones, the study carried out in [43] aims at detecting intruders in SCADA networks by analysing variables of the control devices. Two different approaches of one-class classification, the Support Vector Data Description (SVDD) and the Kernel Principle Component Analysis (KPCA), were proposed as well in [44].…”

Section: Related Workmentioning

confidence: 99%

Machine Learning for Reliable Network Attack Detection in SCADA Systems

Pérez

Adamsky

Soua

et al. 2018

2018 17th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/ 12th IEEE International

View full text Add to dashboard Cite

Critical Infrastructures (CIs) use Supervisory Control And Data Acquisition (SCADA) systems for remote control and monitoring. For a long time, operator of CIs applied the air gap principle, a security strategy that physically isolates the control network from other communication channels. True isolation, however, is difficult nowadays due to the massive spread of connectivity: using open protocols and more connectivity opens new network attacks against CIs. To cope with this dilemma, sophisticated security measures are needed to address malicious intrusions, which are steadily increasing in number and variety. Traditional Intrusion Detection Systems (IDSs) cannot detect attacks that are not already present in their databases. In this paper, we assess Machine Learning (ML) for intrusion detection in SCADA systems using a real data set collected from a gas pipeline system and provided by the Mississippi State University (MSU). The contribution of this paper is twofold: 1) The evaluation of four techniques for missing data estimation and two techniques for data normalization, 2) The performances of Support Vector Machine (SVM), Random Forest (RF), Bidirectional Long Short Term Memory (BLSTM) are assessed in terms of accuracy, precision, recall and F1 score for intrusion detection. Two cases are differentiated: binary and categorical classifications. Our experiments reveal that RF and BLSTM detect intrusions effectively, with an F1 score of respectively > 99% and > 96%.

show abstract

“…Also, the matching prediction is highly complicated due to the presence of more irrelevant features in the database [14]. Thus, the existing works could use the machine learning techniques [15,16] for selecting the best matching features between the query data and set of extracted features. The different types of machine learning [17][18][19][20][21] techniques used in the conventional works are Support Vector Machine (SVM), Relevance Vector Machine (RVM), Neural Networks (NN), and other deep learning models.…”

Section: Introductionmentioning

confidence: 99%

An Enriched RPCO-BCNN Mechanisms for Attack Detection and Classification in SCADA Systems

Shitharth¹,

Prasad

Sangeetha³

et al. 2021

IEEE Access

View full text Add to dashboard Cite

Providing security to the Supervisory Control and Data Acquisition (SCADA) systems is one of the demanding and crucial tasks in recent days, due to the different types of attacks on the network. For this purpose, there are different types of attack detection and classification methodologies have been developed in the conventional works. But it limits with the issues like high complexity in design, misclassification results, increased error rate, and reduced detection efficiency. In order to solve these issues, this paper aims to develop an advanced machine learning models for improving the SCADA security. This work comprises the stages of preprocessing, clustering, feature selection, and classification. At first, the Markov Chain Clustering (MCC) model is implemented to cluster the network data by normalizing the feature values. Then, the Rapid Probabilistic Correlated Optimization (RPCO) mechanism is employed to select the optimal features by computing the matching score and likelihood of particles. Finally, the Block Correlated Neural Network (BCNN) technique is employed to classify the predicted label, where the relevancy score is computed by using the kernel function with the feature points. During experimentation, there are different performance indicators have been used to validate the results of proposed attack detection mechanisms. Also, the obtained results are compared with the RPCO-BCNN mechanism for proving the superiority of the proposed attack detection system.

show abstract

Intrusion detection system for SCADA platforms through machine learning algorithms

Cited by 8 publications

References 7 publications

A Review of Research Works on Supervised Learning Algorithms for SCADA Intrusion Detection and Classification

A Review of Research Works on Supervised Learning Algorithms for SCADA Intrusion Detection and Classification

Machine Learning for Reliable Network Attack Detection in SCADA Systems

An Enriched RPCO-BCNN Mechanisms for Attack Detection and Classification in SCADA Systems

Contact Info

Product

Resources

About