This paper introduces a stacking ensemble model, which combines three single models, to improve intrusion detection in supervisory control and data acquisition (SCADA) systems. The first layer of the proposed model is the combination of random forest, light boosting gradient machine, and eXtreme gradient boosting models. We use an multilayer perceptron (MLP) network as a meta-classifier of the model. The proposed model is optimized and tested on an international dataset (gas pipeline dataset). The tested results show an accuracy of 99.72% with the f1-score of 99.72% for binary classification tasks (attacked or non-attacked detection). For categorical tasks, the detection rates of almost all attack types are higher than 97.55% (except for denial of service (DoS)-95.17%), with an overall accuracy of 99.62%.

No abstract

The problem of detecting linear attacks on industrial systems is presented in this paper. The object is attacked by linear attack is the wireless communication process from sensors to controller with simulated mathematical model (stochastic dynamical systems and random noises). The attack matrices are calculated to ensure that Kullback-Leiber (K-L) algorithm is passed. With these matrices, the window limited cumulative SUM (WL-CUSUM) algorithm and finite moving average (FMA) algorithm are utilized to detect the changes in the sequence of residuals generated from Kalman filter method and are appreciated the ability to detect the linear attack. The simulated results show that an appropriate range of threshold of the WL-CUSUM and FMA algorithm can be chosen to detect the linear attack in case the K-L method cannot detect. Moreover, tested results using the Monte Carlo simulation also show that the evaluation performance of the FMA detection algorithm is better than that of WL-CUSUM, CUSUM, and Chi-squared (Chi2).