Robust Intrusion Detection for Industrial Control Systems Using Improved Autoencoder and Bayesian Gaussian Mixture Model
-
Published:2023-04-26
Issue:9
Volume:11
Page:2048
-
ISSN:2227-7390
-
Container-title:Mathematics
-
language:en
-
Short-container-title:Mathematics
Author:
Wang Chao12, Liu Hongri13, Li Chao3, Sun Yunxiao12, Wang Wenting4, Wang Bailing12
Affiliation:
1. School of Computer Science and Technology, Harbin Institute of Technology, Weihai 264209, China 2. School of Cyber Science and Technology, Harbin Institute of Technology, Harbin 150001, China 3. Weihai Cyberguard Technologies Co., Ltd., Weihai 264209, China 4. State Grid Shandong Electric Power Company, Electric Power Research Institute, Jinan 250003, China
Abstract
Machine learning-based intrusion detection systems are an effective way to cope with the increasing security threats faced by industrial control systems. Considering that it is hard and expensive to obtain attack data, it is more reasonable to develop a model trained with only normal data. However, both high-dimensional data and the presence of outliers in the training set result in efficiency degradation. In this research, we present a hybrid intrusion detection method to overcome these two problems. First, we created an improved autoencoder that incorporates the deep support vector data description (Deep SVDD) loss into the training of the autoencoder. Under the combination of Deep SVDD loss and reconstruction loss, the novel autoencoder learns a more compact latent representation from high-dimensional data. The density-based spatial clustering of applications with noise algorithm is then used to remove potential outliers in the training data. Finally, a Bayesian Gaussian mixture model is used to identify anomalies. It learns the distribution of the filtered training data and uses the probabilities to classify normal and anomalous samples. We conducted a series of experiments on two intrusion detection datasets to assess performance. The proposed model performs better than other baseline methods when dealing with high-dimensional and contaminated data.
Funder
The National Key Research and Development Program of China
Subject
General Mathematics,Engineering (miscellaneous),Computer Science (miscellaneous)
Reference38 articles.
1. Stouffer, K., Pillitteri, V., Lightman, S., Abrams, M., and Hahn, A. (2023, April 25). Guide to Industrial Control Systems (ICS) Security NIST Special Publication 800-82 Revision 2, NIST Special Publication 800-82 Rev 2, Available online: https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final. 2. Kaouk, M., Flaus, J.M., Potet, M.L., and Groz, R. (2019, January 23–26). A review of intrusion detection systems for industrial control systems. Proceedings of the 2019 6th International Conference on Control, Decision and Information Technologies, CoDIT, Paris, France. 3. Anton, S.D., Fraunholz, D., Lipps, C., Pohl, F., Zimmermann, M., and Schotten, H.D. (2017, January 13–14). Two decades of SCADA exploitation: A brief history. Proceedings of the 2017 IEEE Conference on Applications, Information and Network Security, AINS, Miri, Malaysia. 4. Industrial Control Systems: Cyberattack trends and countermeasures;Alladi;Comput. Commun.,2020 5. Hemsley, K.E., and Fisher, R.E. (2023, April 25). History of Industrial Control System Cyber Incidents, INL/CON-18-44411-Revision-2, Available online: https://www.osti.gov/servlets/purl/1505628/.
|
|