A detailed study of resampling algorithms for cyberattack classification in engineering applications.

Area of Science:

• Engineering Informatics
• Cybersecurity
• Data Science

Background:

• Industrial systems face increasing cybersecurity threats due to interconnectedness.
• Heterogeneous data and imbalanced datasets in industrial environments pose significant challenges for cyberattack detection.
• Existing cybersecurity solutions struggle with imbalanced datasets common in simulated cyberattacks.

Purpose of the Study:

• To propose and evaluate a system for addressing class imbalance in cybersecurity datasets for industrial systems.
• To enhance the efficacy of cybersecurity measures through improved cyberattack detection and classification.
• To provide a more comprehensive defense against diverse threats in industrial environments.

Main Methods:

• Tested three oversampling methods: SMOTE, Borderline1-SMOTE, and ADASYN.
• Evaluated five undersampling methods: random undersampling, cluster centroids, NearMiss, repeated edited nearest neighbor, and Tomek Links.
• Developed a two-stage classification system using one-vs-rest binary models with tested balancing algorithms.

Main Results:

• The proposed system demonstrated effectiveness in cyberattack detection and classification.
• Experimental results confirmed the system's ability to handle imbalanced datasets.
• The system successfully identified and classified nine widely known cyberattacks.

Conclusions:

• The developed system effectively addresses class imbalance in industrial cybersecurity.
• The approach enhances the accuracy and reliability of cyberattack detection systems.
• This research contributes to more robust protection of interconnected industrial systems against cyber threats.