LSTM for SCADA Intrusion Detection

Industrial automation and control systems have gained increasing attention in the literature recently. Their integration with various systems has triggered considerable developments in critical infrastructure systems. With different network structures, these systems need to communicate with each other, work in an integrated manner, be controlled, and intervene effectively when necessary. Supervision Control and Data Acquisition (SCADA) systems are mostly utilized to achieve these aims. SCADA systems, which control and monitor the connected systems, have been the target of cyber attackers. These systems are subject to cyberattacks due to the openness to external networks, remote controllability, and SCADA-architecture-specific cyber vulnerabilities. Protecting SCADA systems on critical infrastructure systems against cyberattacks is an important issue that concerns governments in many aspects such as economics, politics, transport, communication, health, security, and reliability. In this study, we physically demonstrated a scaled-down version of a real water plant via a Testbed environment created including a SCADA system. In order to disrupt the functioning of the SCADA system in this environment, five attack scenarios were designed by performing various DDoS attacks, i.e., TCP, UDP, SYN, spoofing IP, and ICMP Flooding. Additionally, we evaluated a scenario with the baseline behavior of the SCADA system that contains no attack. During the implementation of the scenarios, the SCADA system network was monitored, and network data flow was collected and recorded. CNN models, LSTM models, hybrid deep learning models that amalgamate CNN and LSTM, and traditional machine learning models were applied to the obtained data. The test results of various DDoS attacks demonstrated that the hybrid model and the decision tree model are the most suitable for such environments, reaching the highest test accuracy of 95% and 99%, respectively. Moreover, we tested the hybrid model on a dataset that is used commonly in the literature which resulted in 98% accuracy. Thus, it is suggested that the security of the SCADA system can be effectively improved, and we demonstrated that the proposed models have a potential to work in harmony on real field systems.

show abstract

“…The models used the LSTM algorithm. Both detection systems performed well in detecting temporally uncorrelated attacks [25].…”

Section: Literature Studies On Scada Securitymentioning

confidence: 98%

“…Then, the packets of these 6 scenarios were collected in a single file and the total dataset was created. The features frequently used in the literature and specific to the Modbus TCP/IP protocol were determined for this dataset [23,25]. Table 1 shows the features used in this research.…”

Section: Dataset From the Testbedmentioning

confidence: 99%

A Multi-Model Proposal for Classification and Detection of DDoS Attacks on SCADA Systems

SÖĞÜT

Erdem

2023

Applied Sciences

View full text Add to dashboard Cite

show abstract

“…In [29], both a many-to-many and a many-to-one LSTM are designed to address intrusion detection systems for the supervisory control and data acquisition (SCADA) protocol, and their results are compared.…”

Section: Sequence Labelingmentioning

confidence: 99%

A Multi-Agent Adaptive Deep Learning Framework for Online Intrusion Detection

Mahdi¹,

Khajavi²,

Siavoshani³

et al. 2023

Preprint

View full text Add to dashboard Cite

The network security analyzers use intrusion detection systems (IDSes) to distinguish malicious traffic from benign ones. The deep learning-based (DL-based) IDSes are proposed to auto-extract high-level features and eliminate the time-consuming and costly signature extraction process. However, this new generation of IDSes still suffers from a number of challenges. One of the main issues of an IDS is facing traffic concept drift which manifests itself as new (i.e., zero-day) attacks, in addition to the changing behavior of benign users/applications. Furthermore, a practical DL-based IDS needs to be conformed to a distributed architecture to handle big data challenges.In this paper, we propose a framework for adapting DL-based models to the changing attack/benign traffic behaviors, considering a more practical scenario (i.e., online adaptable IDSes). This framework employs continual deep anomaly detectors in addition to the federated learning approach to solve the above-mentioned challenges. Furthermore, the proposed framework implements sequential packet labeling for each flow, which provides an attack probability score for the flow by gradually observing each flow packet and updating its estimation. We evaluate the proposed framework by employing different deep models (including CNN-based and LSTM-based) over the CIC-IDS2017 and CSE-CIC-IDS2018 datasets. Through extensive evaluations and experiments, we show that the proposed distributed framework is well adapted to the traffic concept drift. More precisely, our results indicate that the CNN-based models are well suited for continually adapting to the traffic concept drift (i.e., achieving an average detection rate of above 95% while needing just 128 new flows for the updating phase), and the LSTM-based models are a good candidate for sequential packet labeling in practical online IDSes (i.e., detecting intrusions by just observing their first 15 packets).

show abstract

“…An interesting option is to use LSTM neural networks to establish a protection mechanism against cyber-attacks [ 64 , 65 , 66 ]. LSTMs can learn the temporal behavior of time series sequences.…”

Section: Experimental Evaluation Of Lstm Neural Network In the Scada ...mentioning

confidence: 99%

Forgery Cyber-Attack Supported by LSTM Neural Network: An Experimental Case Study

Zarzycki,

Chaber,

Cabaj

et al. 2023

Sensors

View full text Add to dashboard Cite

This work is concerned with the vulnerability of a network industrial control system to cyber-attacks, which is a critical issue nowadays. This is because an attack on a controlled process can damage or destroy it. These attacks use long short-term memory (LSTM) neural networks, which model dynamical processes. This means that the attacker may not know the physical nature of the process; an LSTM network is sufficient to mislead the process operator. Our experimental studies were conducted in an industrial control network containing a magnetic levitation process. The model training, evaluation, and structure selection are described. The chosen LSTM network very well mimicked the considered process. Finally, based on the obtained results, we formulated possible protection methods against the considered types of cyber-attack.

show abstract

LSTM for SCADA Intrusion Detection

Cited by 11 publications

References 11 publications

A Multi-Model Proposal for Classification and Detection of DDoS Attacks on SCADA Systems

A Multi-Model Proposal for Classification and Detection of DDoS Attacks on SCADA Systems

A Multi-Agent Adaptive Deep Learning Framework for Online Intrusion Detection

Forgery Cyber-Attack Supported by LSTM Neural Network: An Experimental Case Study

Contact Info

Product

Resources

About