Interdisciplinary framework for cyber-attacks and anomaly detection in industrial control systems using deep...

Area of Science:

• Cybersecurity
• Industrial Control Systems (ICS)
• Network Intrusion Detection

Background:

• Industrial Control Systems (ICS) are vital for society and business but vulnerable to cyberattacks.
• Existing intrusion detection systems (IDS) struggle with imbalanced ICS datasets, leading to poor performance on minority classes.
• The increasing prevalence of IoT and cyber warfare necessitates robust ICS cybersecurity measures.

Purpose of the Study:

• To develop an interdisciplinary framework to enhance network intrusion detection systems (NIDSs) for Industrial Control Systems (ICS).
• To address dataset imbalances and improve the detection of cyberattacks in ICS environments.
• To provide insights into normal system functioning and cyberattack disruptions.

Main Methods:

• Implemented an IDS using feature selection and reduction techniques, including Sparse Principal Component Analysis (SPCA).
• Utilized attention-driven lightweight deep neural networks: Deep Recurrent Neural Networks (RNN), Deep Long Short-Term Memory (LSTM), and Deep Bi-directional Long Short-Term Memory (Bi-LSTM).
• Conducted experiments on Secure Water Treatment System (SWaT), Water Distribution (WADI), and Gas Heating Loop (GHL) datasets.

Main Results:

• The attention-driven Deep LSTM model outperformed other models in training and testing times across all datasets.
• The proposed framework demonstrated superior precision, recall, and F1-score compared to previous methods.
• The framework showed enhanced computational speed and scalability for larger datasets and diverse ICS environments.

Conclusions:

• The developed framework significantly improves cyberattack detection in Industrial Control Systems (ICS).
• Attention-driven Deep LSTM offers an effective and efficient solution for NIDS in ICS.
• The findings underscore the framework's real-world applicability for safeguarding critical infrastructure.