A real time OCSVM Intrusion Detection module with low overhead for SCADA systems

Abstract

Abstract-In this paper we present a intrusion detection module capable of detecting malicious network traffic in a SCADA (Supervisory Control and Data Acquisition) system. Malicious data in a SCADA system disrupt its correct functioning and tamper with its normal operation. OCSVM (One-Class Support Vector Machine) is an intrusion detection mechanism that does not need any labeled data for training or any information about the kind of anomaly is expecting for the detection process. This feature makes it ideal for processing SCADA environment data and automate SCADA performance monitoring. The OCSVM module developed is trained by network traces off line and detect anomalies in the system real time.In order to decrease the overhead induced by communicated alarms we propose a new detection mechanism that is based on the combination of OCSVM with a recursive k-means clustering procedure. The proposed intrusion detection module K−OCSVM is capable to distinguish severe alarms from possible attacks regardless of the values of parameters σ and ν, making it ideal for real-time intrusion detection mechanisms for SCADA systems. The most severe alarms are then communicated with the use of IDMEF files to an IDSIDS (Intrusion Detection System) system that is developed under CockpitCI project. Alarm messages carry information about the source of the incident, the time of the intrusion and a classification of the alarm.

Autoencoder Based Anomaly Detection for SCADA Networks

“…The research applying machine learning techniques using publicly available SCADA datasets and some of the related techniques on public datasets are outlined in Table 1. One Class Support Vector Machine (OCSVM) for automated anomaly detection (Schuster, et al, 2015) from SCADA telecommunications data was used by (Jiang & Yasakethu, 2013;Maglaras, & Jiang, 2014). They proposed clustering the anomalies into different types to generate a corresponding alarm.…”

“…Gas Pipeline MLP with GWO (Mansouri, et al, 2017) Gas Pipeline K-means, Naïve Bayesian, PCA-SVD, GMM (Shirazi et al, 2016) Gas pipeline LSTM (Feng et al, 2017) Water Distribution System (DUWWTP) KNN, K-means (Almalawi, et al, 2014) DUWWTP, Gas pipeline SVDD, PCA (Nader et al, 2014) Network trace OCSVM, K-means (Maglaras, & Jiang, 2014) CERT Insider Threat RNN (Tuor et al, 2017) algorithms is provided (Mansouri, et. al., 2017) for anomaly detection in a gas distribution network (Beaver, et al, 2013) and dimensionality reduction techniques for improving accuracy were also used.…”

“…The machine learning application to reduce the manual configurations for IDS is discussed by (Mantere, et al, 2013). An IDS to detect malicious traffic was described by (Maglaras, & Jiang, 2014) combining OCSVM with recursive K-means clustering to minimize false alarms. OCSVM was found to perform well in comparison to other methods for anomaly detection; however, the performance could degrade for higher dimensional problems (Sander, 2017).…”