An Intrusion Detection Method for Industrial Control System Based on Machine Learning

Abstract

The integration of communication networks and the internet of industrial control in Industrial Control System (ICS) increases their vulnerability to cyber attacks, causing devastating outcomes. Traditional Intrusion Detection Systems (IDS) largely rely on predefined models and are trained mostly on specific cyber attacks, which means the traditional IDS cannot cope with unknown attacks. Additionally, most IDS do not consider the imbalanced nature of ICS datasets, thus suffering from low accuracy and high False Positive Rates when being put to use. In this paper, we propose the NCO–double-layer DIFF_RF–OPFYTHON intrusion detection method for ICS, which consists of NCO modules, double-layer DIFF_RF modules, and OPFYTHON modules. Detected traffic will be divided into three categories by the double-layer DIFF_RF module: known attacks, unknown attacks, and normal traffic. Then, the known attacks will be classified into specific attacks by the OPFYTHON module according to the feature of attack traffic. Finally, we use the NCO module to improve the model input and enhance the accuracy of the model. The results show that the proposed method outperforms traditional intrusion detection methods, such as XGboost and SVM. The detection of unknown attacks is also considerable. The accuracy of the dataset used in this paper reaches 98.13%. The detection rates for unknown attacks and known attacks reach 98.21% and 95.1%, respectively. Moreover, the method we proposed has achieved suitable results on other public datasets.

Nesting Circles: An Interactive Visualization Paradigm for Network Intrusion Detection System Alerts

“…Since the patterns of the attacks are not defnable with the exact and complete details (in the case of signature-based IDSs) and the system may make a mistake in detecting an attack (in the case of anomaly-based IDSs), there are numerous situations that the IDS incorrectly alerts for an existing attack or a suspicious packet while the Internet trafc resembles an attack pattern but no attack is happening [4]. Tese alerts are called false-positive alerts, and the problem they raise is called the false-positive alerts problem.…”

Integrated Approach to Diagnostics of Failures and Cyber-Attacks in Industrial Control Systems

“…Specialized IDS tools dedicated to OT are already offered on the market. Machine learning based approaches are still being explored, such as the hybrid system for distinguishing between attacks with known signatures, attacks with unknown signatures, and normal network traffic described in [59]. The third solution, on the other hand, is specific to control systems.…”