Source-linked AI summary
An Ensemble Deep Learning-based Cyber-Attack Detection in Industrial Control System
Abdulrahman Al-Abassi, Hadis Karimipour, Ali Dehghantanha, Reza M. Parizi
TL;DR
ICS connectivity increases cyber-attack exposure, while traditional IDSs are often IT-oriented and existing approaches neglect imbalanced ICS datasets. The paper learns balanced representations with stacked autoencoders and classifies them using an ensemble of DNN and DT models. Evaluations on two real ICS datasets report higher performance than conventional and peer approaches, including under varying imbalance conditions.
Problem
Existing ICS attack-detection approaches often neglect severe class imbalance, while many IDSs are designed for IT systems or specific attacks and environments.
Method
The method uses multiple unsupervised stacked autoencoders to learn balanced representations, then applies DNN and DT classifiers in an ensemble detector.
Results
The proposed method outperformed conventional classifiers and peer approaches across accuracy, precision, recall, and F1-score on two real ICS datasets.
Takeaways & Limitations
The approach is presented as generalized across ICS environments and capable of operating with minimum changes to existing infrastructures.
Abstract
from arXiv · showhide
The integration of communication networks and the Internet of Things (IoT) in Industrial Control Systems (ICSs) increases their vulnerability towards cyber-attacks, causing devastating outcomes. Traditional Intrusion Detection Systems (IDSs), which are mainly developed to support Information Technology (IT) systems, count vastly on predefined models and are trained mostly on specific cyber-attacks. Besides, most IDSs do not consider the imbalanced nature of ICS datasets, thereby suffering from low accuracy and high false positive on real datasets. In this paper, we propose a deep representation learning model to construct new balanced representations of the imbalanced dataset. The new representations are fed into an ensemble deep learning attack detection model specifically designed for an ICS environment. The proposed attack detection model leverages Deep Neural Network (DNN) and Decision Tree (DT) classifiers to detect cyber-attacks from the new representations. The performance of the proposed model is evaluated based on 10-fold cross-validation on two real ICS datasets. The results show that the proposed method outperforms conventional classifiers, including Random Forest (RF), DNN, and AdaBoost, as well as recent existing models in the literature. The proposed approach is a generalized technique, which can be implemented in existing ICS infrastructures with minimum changes.
I. INTRODUCTION
ICS connectivity has expanded cyber-attack exposure, while conventional and existing learning-based IDSs remain limited by IT-oriented design, attack specificity, weak generalization, and imbalanced datasets. The paper proposes a generalized ensemble deep learning approach that creates balanced representations and combines DNN and DT classifiers for ICS attack detection.
- ICS attacks can disrupt operations, damage physical systems, or misrepresent system states, threatening critical infrastructure such as power, gas, and water.
- Traditional IT-oriented IDSs and unsecured ICS protocols may fail to detect attacks specific to OT environments.
- Existing approaches often target known attacks or specific systems and frequently neglect imbalanced ICS datasets, causing low detection rates or high false positives.
- The proposed method learns balanced representations from imbalanced data and uses DNN and DT classifiers to improve attack detection accuracy and false-positive performance.
- The framework is intended to generalize across critical infrastructure facilities and operate with minimum changes to existing systems.
- IoT, Internet protocols, and wireless technologies reduced ICS isolation, increasing vulnerabilities beyond the safety mechanisms originally designed for these systems.
A. Industrial Control Systems
A typical SCADA-based ICS network links remote, primary, and regional centers through wired or radio networks. The primary center gathers sensor data, detects irregularities, and sends operational instructions to remote stations.
- A typical SCADA ICS architecture consists mainly of remote, primary, and regional centers connected through wide/local area networks or Radio Telemetry.
- The primary center collects field-sensor data, identifies setpoints, and detects irregularities in network operations.
- Instructions are sent to remote stations to monitor telemetry from field devices, while regional stations manage communication and regional power consumption.
- The paper models ICS processes as non-linear and non-Gaussian systems with state, sensor-measurement, process-noise, and sensor-noise variables.
B. Adversary Model
The adversary model covers integrity attacks that inject false sensor data and availability attacks that cause measurement or packet loss. These attacks manipulate readings or communication channels to disrupt state estimation.
- The study considers False Data Injection as an integrity attack and Denial of Service as an availability attack.
- In an FDI attack, the observed measurement combines the true sensor measurement with injected noise selected by an attack vector.
- A malicious node is selected when its sensor-selection-vector element equals 1, and an intruder can exploit up to f of m sensors.
- DoS attacks model measurement or packet loss using Bernoulli or Markov processes.
- Attackers can manipulate sensor readings and jam communication channels by flooding network packets, producing corrupted measurements for the state estimator.
IV. Proposed Method
The proposed method learns new balanced representations from raw imbalanced ICS datasets and feeds them into an ensemble deep learning classifier. Multiple unsupervised SAEs generate representations that are used for attack classification.
- The model generates a new balanced representation from a raw imbalanced dataset before classification.
- Multiple unsupervised Stacked Autoencoders learn representations from the imbalanced dataset for the ensemble attack detector.
A. The Proposed Ensemble Deep Representation Learning Model
The model addresses imbalanced ICS attack detection by generating new representations from balanced samples and using stacked autoencoders before classification.
- The approach targets the low f-measure and practical difficulty caused by highly imbalanced ICS datasets.
- The proposed model extracts an equal balanced set from imbalanced data and generates new representations through multiple autoencoders.
- Multiple stacked autoencoders learn representations from unlabeled data to capture different patterns in the input.
- Dropout reduces reliance on specific parameters, while network structure is selected through cross-validation of alternative configurations.
- Binary Cross-Entropy is used as the autoencoder cost function to prevent hidden-layer weight updates from becoming progressively smaller.
B. The Proposed Ensemble Deep Learning Attack Detection Model
The attack detection stage combines DNN outputs from newly generated representations and applies a Decision Tree to classify normal and abnormal behavior.
- Each generated representation is passed to a DNN, whose outputs are concatenated into a super vector for final classification.
- A Decision Tree performs binary attack detection on the newly merged representation after fusion of the DNN outputs.
- The fusion loss weights unstable samples more heavily than stable samples, with the stable-sample weight fixed at 1.
- Stacked autoencoders and DNN classifiers use Binary Cross-Entropy and Rectified Linear Unit activation functions.
A. Data Preparation
The study evaluates the proposed algorithm on two realistic ICS datasets: Gas Pipeline and Secure Water Treatment, each divided into training and testing subsets.
- Two ICS datasets obtained in 2015 and 2018 are used because new real SCADA data were ideally desirable but unavailable.
- The Gas Pipeline dataset contains 17 features and 274628 observations, split into 80% training and 20% testing samples.
- The Secure Water Treatment dataset contains 51 features and 1048576 observations from seven normal-operation days and four attack-scenario days.
- The Secure Water Treatment dataset is split into 838860 training and 209715 testing observations.
B. Evaluation Metrics
Evaluation emphasizes attack detection on imbalanced ICS data, using confusion-matrix metrics and especially F1 score to balance precision and recall.
- The evaluation uses True Positives, False Positives, True Negatives, and False Negatives as attack-detection performance measures.
- Accuracy is the ratio of correctly classified samples to all samples, while precision measures correctly classified positive samples.
- Recall is the ratio of correctly predicted positive samples to the total samples of the corresponding class.
- F1 Score is the harmonic mean of precision and recall.
- F1 score is emphasized because it balances precision and recall when attack samples are much fewer than normal samples.
C. Performance Analysis
The proposed method was evaluated on gas pipeline and water treatment ICS datasets under varying imbalance conditions. It outperformed existing techniques across accuracy, precision, recall, and F1-score while maintaining robust performance as imbalance ratios changed.
- The proposed method outperformed existing techniques across accuracy, precision, recall, and F1-score on both evaluated ICS datasets.The comparison included conventional classifiers and multiple approaches from the literature.
- General Performance Analysis: The evaluation used gas pipeline and water treatment ICS datasets to assess general performance.The datasets represented two different real ICS environments.
- Imbalanced Testing: Imbalance ratios represented the proportion of attack samples used, ranging from 10% at ratio 0.1 to 100% at ratio 1.The imbalance testing procedure varied the amount of attack data available to the model.
- Imbalanced Testing: The proposed method maintained consistent performance across different imbalance ratios on the Gas Pipeline dataset.Its curves remained flat and exceeded other techniques across all four metrics.
- General Performance Analysis: The proposed model outperformed existing techniques across all four metrics on the SWaT dataset without modifying its structure or parameters.The paper attributes stronger SWaT performance to having more training samples than the Gas Pipeline dataset.
V. CONCLUSION
The paper concludes that its generalized ensemble deep learning method improves cyber-attack detection for ICSs by learning balanced representations from imbalanced data. Across two real infrastructure datasets, it achieved higher F1-scores and accuracy than conventional and peer methods.
- The method combines deep representation learning with DNN and DT classifiers to detect cyber-attacks in ICSs.Balanced representations are constructed from raw imbalanced datasets before attack detection.
- 10% higher F1-score was achieved than conventional classifiers on both evaluated datasets.The conclusion reports accuracy values of 95.86% for Gas Pipeline and 99.67% for Secure Water Treatment.
- The proposed approach outperformed other techniques across all four evaluation metrics.The comparison included RF, DNN, AdaBoost, and multiple peer approaches from the literature.
- The approach is presented as generalized for different ICS environments and existing critical-infrastructure systems.The conclusion frames the method as applicable across two real ICS datasets.