Detecting cyberattacks in industrial control systems using online learning algorithms

Abstract

Industrial control systems are critical to the operation of industrial facilities, especially for critical infrastructures, such as refineries, power grids, and transportation systems. Similar to other information systems, a significant threat to industrial control systems is the attack from cyberspace-the offensive maneuvers launched by "anonymous" in the digital world that target computer-based assets with the goal of compromising a system's functions or probing for information. Owing to the importance of industrial control systems, and the possibly devastating consequences of being attacked, significant endeavors have been attempted to secure industrial control systems from cyberattacks. Among them are intrusion detection systems that serve as the first line of defense by monitoring and reporting potentially malicious activities. Classical machine-learning-based intrusion detection methods usually generate prediction models by learning modest-sized training samples all at once. Such approach is not always applicable to industrial control systems, as industrial control systems must process continuous control commands with limited computational resources in a nonstop way. To satisfy such requirements, we propose using online learning to learn prediction models from the controlling data stream. We introduce several state-of-the-art online learning algorithms categorically, and illustrate their efficacies on two typically used testbeds-power system and gas pipeline. Further, we explore a new cost-sensitive online learning algorithm to solve the class-imbalance problem that is pervasive in industrial intrusion detection systems. Our experimental results indicate that the proposed algorithm can achieve an overall improvement in the detection rate of cyberattacks in industrial control systems.

Network Intrusion Detection Based on Conditional Wasserstein Generative Adversarial Network and Cost-Sensitive Stacked Autoencoder

“…To solve the problem of the class imbalance that is common in industrial intrusion detection systems, Li et al [15] proposed a cost-sensitive online learning algorithm. Experiments conducted on the two test data of the natural gas pipeline system and power system have proved that the algorithm can effectively improve the detection rate of network attacks in industrial control systems.…”

“…From the algorithm, considering the difference in the cost of different misclassification situations, introducing cost-sensitive factors and designing a cost-sensitive classification algorithm is one of the methods to solve the problem of class imbalance. At present, the use of costsensitive algorithms to solve the class imbalance problem in the field of intrusion detection is also involved, such as the literature [15][16]. Regarding solving the problem of data imbalance and unknown attack detection in intrusion detection, this paper proposes a novel network intrusion detection model called CWGAN-CSSAE, which combines improved CWGAN and a cost-sensitive stacked autoencoder.…”

Near-infrared polarimetric study of near-Earth object 252P/LINEAR: an implication of scattered light from the evolved dust particles

“…Accordingly, as the wavelength of the incident light increases (i.e., more monomers are covered in a single wavelength), P r of such compact particles decreases more rapidly than that of the porous particles due to the enhanced electromagnetic interaction (Gustafson & Kolokolova 1999;Kolokolova & Kimura 2010). Compared to the non/long-periodic comets observed at similar phase angles, it is more likely that the near-surface of 252P has a paucity of small, fluffy dust particles owing to its more frequent perihelion passages in the near-Earth orbit (e.g., Li & Greenberg 1998;Kolokolova et al 2007). The circumstance would emerge as the unusual blue PC of the comet.…”

Psycholinguistic Aspects of Humanitarian Component of Cybersecurity

“…Burov, N.P. Dementievska (2019), G. Li et al (2019) address the pedagogical basis in the designing of cybersecurity educational courses suited to a broad target audience, since people are not trained to prevent cyberattacks.…”

“…G. Li et al (2019) point out that the lack of cybersecurity awareness can lead to a cyberattack. The authors propose to introduce online courses to work at a number of training models aimed at developing competencies and skills to detect unauthorized access to closed systems.…”