Ensemble Learning-Enabled Security Anomaly Identification for IoT Cyber–Physical Power Systems

Zhao, Hongjun; Li, Changjun; Yin, Xiaoxing; Li, Xiujun; Zhou, Rui; Fu, Rong

doi:10.3390/electronics11234043

Cited by 1 publication

(1 citation statement)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Zhao et al [23] propose a novel Ensemble Learning algorithm for anomaly detection on smart power grids, focusing on feature matching across a federated learning environment to determine if anomalous behaviour is the result of a physical fault (i.e., power line break due to weather or other environmental conditions) or actions of a malicious actor (i.e., network-based attack). The proposed model attempts to represent the smart power grid as a state machine, with normal behaviour modeled as state transitions that are processed with multiple base classifiers in an ensemble model to detect anomalous behaviour.…”

Section: Related Workmentioning

confidence: 99%

Using Ensemble Learning for Anomaly Detection in Cyber–Physical Systems

Jeffrey,

Tan,

Villar

2024

Electronics

View full text Add to dashboard Cite

The swift embrace of Industry 4.0 paradigms has led to the growing convergence of Information Technology (IT) networks and Operational Technology (OT) networks. Traditionally isolated on air-gapped and fully trusted networks, OT networks are now becoming more interconnected with IT networks due to the advancement and applications of IoT. This expanded attack surface has led to vulnerabilities in Cyber–Physical Systems (CPSs), resulting in increasingly frequent compromises with substantial economic and life safety repercussions. The existing methods for the anomaly detection of security threats typically use simple threshold-based strategies or apply Machine Learning (ML) algorithms to historical data for the prediction of future anomalies. However, due to the high levels of heterogeneity across different CPS environments, minimizing the opportunities for transfer learning, and the scarcity of real-world data for training, the existing ML-based anomaly detection techniques suffer from a poor predictive performance. This paper introduces a hybrid anomaly detection approach designed to identify threats to CPSs by combining the signature-based anomaly detection typically utilized in IT networks, the threshold-based anomaly detection typically utilized in OT networks, and behavioural-based anomaly detection using Ensemble Learning (EL), which leverages the strengths of multiple ML algorithms against the same dataset to increase the accuracy. Multiple public research datasets were used to validate the proposed approach, with the hybrid methodology employing a divide-and-conquer strategy to offload the detection of certain cyber threats to computationally inexpensive signature-based and threshold-based methods using domain knowledge to minimize the size of the behavioural-based data needed for ML model training, thus achieving a higher accuracy over a reduced timeframe. The experimental results showed accuracy improvements of 4–7% over those of the conventional ML classifiers in performing anomaly detection across multiple datasets, which is particularly important to the operators of CPS environments due to the high financial and life safety costs associated with interruptions to system availability.

show abstract

Section: Related Workmentioning

confidence: 99%