Machine Learning for Anomaly Detection and Categorization in Multi-Cloud Environments

Salman, Tara; Bhamare, Deval; Erbad, Aiman; Jain, Raj; Samaka, Mohammed

doi:10.1109/cscloud.2017.15

Cited by 87 publications

(55 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…As shown in Table 5, our dataset is unbalanced. Therefore, accuracy is not the ideal measure to evaluate the performance [33]. Other metrics are needed to compare the performance of the ML algorithms.…”

Section: Numerical Resultsmentioning

confidence: 99%

SCADA System Testbed for Cybersecurity Research Using Machine Learning Approach

et al. 2018

Self Cite

View full text Add to dashboard Cite

This paper presents the development of a SCADA system testbed used for cybersecurity research. The testbed consists of a water storage tank's control system, which is a stage in the process of water treatment and distribution. Sophisticated cyber-attacks are conducted against the testbed. During the attacks, the network traffic is captured, and features are extracted from the traffic to build a dataset for training and testing different machine learning algorithms. Five traditional machine learning algorithms are trained to detect the attacks: Random Forest, Decision Tree, Logistic Regression, Naïve Bayes and KNN. After that, the trained machine learning models are built and deployed in the network, where new tests are made using online network traffic. The performance obtained during the training and test of the machine learning models is compared to the performance obtained during the online deployment of these models in the network. The results show the efficiency of the machine learning models in detecting the attacks in real time. The testbed provides a good understanding of the effects and consequences of attacks on real SCADA environments.

show abstract

Section: Numerical Resultsmentioning

confidence: 99%

SCADA System Testbed for Cybersecurity Research Using Machine Learning Approach

et al. 2018

Self Cite

View full text Add to dashboard Cite

show abstract

“…A. Our Preliminary work: In our preliminary work [41,46], we have demonstrated that machine learning techniques need significant rework to perform satisfactorily in the context of anomaly detection in ICSs. The major challenge in the application of machine learning methods is obtaining real-time and unbiased datasets.…”

Section: Research Challengesmentioning

confidence: 99%

Cybersecurity for industrial control systems: A survey

Bhamare

Zolanvari

Erbad

et al. 2020

Computers & Security

Self Cite

216

View full text Add to dashboard Cite

Industrial Control System (ICS) is a general term that includes supervisory control & data acquisition (SCADA) systems, distributed control systems (DCS), and other control system configurations such as programmable logic controllers (PLC). ICSs are often found in the industrial sectors and critical infrastructures, such as nuclear and thermal plants, water treatment facilities, power generation, heavy industries, and distribution systems. Though ICSs were kept isolated from the Internet for so long, significant achievable business benefits are driving a convergence between ICSs and the Internet as well as information technology (IT) environments, such as cloud computing. As a result, ICSs have been exposed to the attack vectors used in the majority of cyber-attacks. However, ICS devices are inherently much less secure against such advanced attack scenarios. A compromise to ICS can lead to enormous physical damage and danger to human lives. In this work, we have a close look at the shift of the ICS from stand-alone systems to cloud-based environments. Then we discuss the major works, from industry and academia towards the development of the secure ICSs, especially applicability of the machine learning techniques for the ICS cyber-security. The work may help to address the challenges of securing industrial processes, particularly while migrating them to the cloud environments.

show abstract

“…The authors in [12] performed random forest binary classification on various stages to classify eight kinds of attacks. They compared logistic regression and random forest for anomaly detection and showed that RF outperformed LR.…”

Section: Related Workmentioning

confidence: 99%

Multi-layer intrusion detection system with ExtraTrees feature selection, extreme learning machine ensemble, and softmax aggregation

Sharma

Giri

Granmo

et al. 2019

EURASIP J. on Info. Security

View full text Add to dashboard Cite

Recent advances in intrusion detection systems based on machine learning have indeed outperformed other techniques, but struggle with detecting multiple classes of attacks with high accuracy. We propose a method that works in three stages. First, the ExtraTrees classifier is used to select relevant features for each type of attack individually for each (ELM). Then, an ensemble of ELMs is used to detect each type of attack separately. Finally, the results of all ELMs are combined using a softmax layer to refine the results and increase the accuracy further. The intuition behind our system is that multi-class classification is quite difficult compared to binary classification. So, we divide the multi-class problem into multiple binary classifications. We test our method on the UNSW and KDDcup99 datasets. The results clearly show that our proposed method is able to outperform all the other methods, with a high margin. Our system is able to achieve 98.24% and 99.76% accuracy for multi-class classification on the UNSW and KDDcup99 datasets, respectively. Additionally, we use the weighted extreme learning machine to alleviate the problem of imbalance in classification of attacks, which further boosts performance. Lastly, we implement the ensemble of ELMs in parallel using GPUs to perform intrusion detection in real time.

show abstract

Machine Learning for Anomaly Detection and Categorization in Multi-Cloud Environments

Cited by 87 publications

References 22 publications

SCADA System Testbed for Cybersecurity Research Using Machine Learning Approach

SCADA System Testbed for Cybersecurity Research Using Machine Learning Approach

Cybersecurity for industrial control systems: A survey

Multi-layer intrusion detection system with ExtraTrees feature selection, extreme learning machine ensemble, and softmax aggregation

Contact Info

Product

Resources

About