A Lightweight Unsupervised Intrusion Detection Model Based on Variational Auto-Encoder

Area of Science:

• Computer Science
• Cybersecurity
• Industrial Control Systems

Background:

• Industrial control systems (ICSs) are increasingly connected to public networks, creating significant security vulnerabilities.
• Attacks on ICSs can lead to equipment failure, data breaches, and production downtime.
• Existing intrusion detection systems often overlook resource constraints in ICS environments, limiting their practical application.

Purpose of the Study:

• To develop a lightweight, unsupervised intrusion detection model for ICS environments.
• To address the challenge of limited resources in ICSs while maintaining effective threat detection.
• To balance intrusion detection accuracy with system resource overhead.

Main Methods:

• Data preprocessing using the spectral residual (SR) algorithm.
• Reconstruction of data using an improved lightweight variational autoencoder (LVA) with autoregression.
• Anomaly detection based on the permutation entropy (PE) algorithm.
• Development of the LVA-SP model, featuring a simplified network structure and fewer parameters.

Main Results:

• The LVA-SP model achieved an F1-score of 84.81% on an ICS dataset.
• Demonstrated advantages in terms of reduced time and memory overhead compared to existing methods.
• Successfully balanced detection accuracy with system resource requirements.

Conclusions:

• The LVA-SP model offers a practical and efficient solution for intrusion detection in resource-constrained ICS environments.
• The lightweight design makes it suitable for real-world deployment in industrial settings.
• The study highlights the importance of considering resource limitations in the development of ICS security mechanisms.