Leveraging Deep Reinforcement Learning Technique for Intrusion Detection in SCADA Infrastructure

Abstract

The prevalence of cyber-attacks perpetrated over the last two decades, including coordinated attempts to breach targeted organizations, has drastically and systematically exposed some of the more critical vulnerabilities existing in our cyber ecosystem. Particularly in Supervisory Control and Data Acquisition (SCADA) systems with targeted attacks aiming to bypass signature-based protocols, attempting to gain control over operational processes. In the past, researchers utilized deep learning and reinforcement learning algorithms to mitigate threats against industrial control systems (ICS). However, as technology evolves, these techniques become ineffective in monitoring and enhancing the cybersecurity defenses of those system against unwanted attacks. To address these concerns, we propose a deep reinforcement learning (DRL) framework for anomaly detection in the SCADA network. Our model utilizes a "Q-network", which allows it to achieve state-of-the-art performance in pattern recognition from complex tasks. We validated our solution on two publicly available datasets. The WUSTL-IIoT-2018 and the WUSTL-IIoT-2021, each comprised of twenty-five networking features representing benign and attack traffic. The results showed that our model successfully achieved an accuracy of 99.36% in attack detection, highlighting DRL's potential to enhance the security of critical infrastructure and laying the foundation for future research in this domain.

XAI-IDS: Toward Proposing an Explainable Artificial Intelligence Framework for Enhancing Network Intrusion Detection Systems

“…Moreover, other prior works have discussed the proliferation of network threats and cyber-attacks in recent years and emphasized the need for the development of sophisticated IDSs capable of not only detecting but also effectively mitigating such threats [29,30]. Additionally, the integration of deep learning techniques into IDSs has shown promising results in real-time anomaly detection for IoT and SCADA infrastructures [31,32]. This diversified foundation further supports this study's exploration of XAI within network IDSs.…”

“…They emphasize the need for XAI to provide clarity on AI decisions, enhancing security measures against cyber threats. On the other hand, the works in [29,31,32] propose frameworks to enhance IDSs in the context of IoT and SCADA Systems. It is also worth mentioning [29,30,79], which do the same for network intrusion detection, leveraging ensemble learning and neural network applications.…”

“…This research introduces a novel approach to intrusion detection that is distinctly advanced beyond previous contributions and addresses the limitations observed in the referenced studies. Unlike the methodologies presented in [29][30][31][32][76][77][78][79][80], which primarily focus on leveraging existing models and algorithms for feature selection and detection or on XAI but applied to different scenarios, such as IoT, autonomous vehicles, or healthcare, this study integrates these techniques within a unique framework that employs explainable AI (XAI) to enhance transparency and interpretability in intrusion detection systems in the context of network intrusion detection. The integration of XAI not only builds on the robust detection capabilities highlighted in [71,78] but also provides the benefits of interpretability and trust [70,71].…”