Forget the Myth of the Air Gap: Machine Learning for Reliable Intrusion Detection in SCADA Systems

Abstract

Since Critical Infrastructures (CIs) use systems and equipment that are separated by long distances, Supervisory Control And Data Acquisition (SCADA) systems are used to monitor their behaviour and to send commands remotely. For a long time, operator of CIs applied the air gap principle, a security strategy that physically isolates the control network from other communication channels. True isolation, however, is difficult nowadays due to the massive spread of connectivity: using open protocols and more connectivity opens new network attacks against CIs. To cope with this dilemma, sophisticated security measures are needed to address malicious intrusions, which are steadily increasing in number and variety. However, traditional Intrusion Detection Systems (IDSs) cannot detect attacks that are not already present in their databases. To this end, we assess in this paper Machine Learning (ML) techniques for anomaly detection in SCADA systems using a real data set collected from a gas pipeline system and provided by the Mississippi State University (MSU). The contribution of this paper is twofold: 1) The evaluation of four techniques for missing data estimation and two techniques for data normalization, 2) The performances of Support Vector Machine (SVM), Random Forest (RF), Bidirectional Long Short Term Memory (BLSTM) are assessed in terms of accuracy, precision, recall and F 1 score for intrusion detection. Two cases are differentiated: binary and categorical classifications. Our experiments reveal that RF and BLSTM detect intrusions effectively, with an F 1 score of respectively > 99% and > 96%.

LoGD-ai: An Efficient Network Intrusion Detection System Using a Soft Voting-Based Ensemble Learner

“…The results revealed that the proposed model has the capacity to improve accuracy and recall and reduce false positive rate (FPR) while achieving the highest detection rates for unknown attacks. With F-1 values of 99% and 96% for Random Forest (RF) and Bidirectional Long Short-Term Memory (BLSTM), [18] concluded that RF and BLSTM successfully identify intrusions on SCADA systems. The study also suggests that standard intrusion detection systems cannot detect assaults that are not currently in their databases.…”

A smart PLC-SCADA framework for monitoring petroleum products terminals in industry 4.0 via machine learning

“…The limitations of the selected supplier are some deficiencies in the tendering and project implementation phases, such as Factory Acceptance Test facilities (FAT), response speed, and training for operational and maintenance staff. Other framework was introduced in R. Lopez Perez et al, F. Adamsky et al R. Sousa, and T. Engel 7 to defend a Supervisory Control and Data Acquisition (SCADA) approach opposed to outbursts utilizing Machine learning (ML) techniques. Their work concentrated on assessing ML performance in identifying anomalies in SCADA structures.…”