A Lightweight Unsupervised Intrusion Detection Model Based on Variational Auto-Encoder

Abstract

With the gradual integration of internet technology and the industrial control field, industrial control systems (ICSs) have begun to access public networks on a large scale. Attackers use these public network interfaces to launch frequent invasions of industrial control systems, thus resulting in equipment failure and downtime, production data leakage, and other serious harm. To ensure security, ICSs urgently need a mature intrusion detection mechanism. Most of the existing research on intrusion detection in ICSs focuses on improving the accuracy of intrusion detection, thereby ignoring the problem of limited equipment resources in industrial control environments, which makes it difficult to apply excellent intrusion detection algorithms in practice. In this study, we first use the spectral residual (SR) algorithm to process the data; we then propose the improved lightweight variational autoencoder (LVA) with autoregression to reconstruct the data, and we finally perform anomaly determination based on the permutation entropy (PE) algorithm. We construct a lightweight unsupervised intrusion detection model named LVA-SP. The model as a whole adopts a lightweight design with a simpler network structure and fewer parameters, which achieves a balance between the detection accuracy and the system resource overhead. Experimental results on the ICSs dataset show that our proposed LVA-SP model achieved an F1-score of 84.81% and has advantages in terms of time and memory overhead.

Methodology for the Detection of Contaminated Training Datasets for Machine Learning-Based Network Intrusion-Detection Systems

“…Different strategies have been employed to detect anomalies in NIDS through various machine learning techniques [ 4 , 5 ], including statistical techniques like Principal Component Analysis (PCA) [ 6 ] or Markov models [ 7 , 8 ]; classification techniques like Artificial Neural Networks (ANNs) [ 9 , 10 , 11 , 12 ], Support Vector Machines (SVMs) [ 6 ], deep learning models [ 13 , 14 ] including Autoencoders [ 9 , 15 ], or Decision Trees including Random Forest [ 16 ]; and clustering like outlier detection [ 17 ]. Using these techniques requires a multi-perspective approach to tackling the problem, which can be categorised as supervised, semi-supervised, or unsupervised, depending on the specific technique chosen [ 18 ].…”