ICS cyber attack detection with ensemble machine learning and DPI using cyber-Kit datasets

Mubarak, Sinil and Habaebi, Mohamed Hadi and Islam, Md. Rafiqul and Khan, Sheroz (2021) ICS cyber attack detection with ensemble machine learning and DPI using cyber-Kit datasets. In: 2021 8TH INTERNATIONAL CONFERENCE ON COMPUTER COMMUNICATION ENGINEERING (ICCCE), 22-23 June 2021, Kuala Lumpur, Malaysia.

	PDF (schedule) - Supplemental Material Restricted to Registered users only Download (392kB) | Request a copy
	PDF (SCOPUS) - Supplemental Material Restricted to Registered users only Download (238kB) | Request a copy
	PDF - Published Version Restricted to Registered users only Download (3MB) | Request a copy

Abstract

Digitization has pioneered to drive exceptional changes across all industries in the advancement of analytics, automation, and Artificial Intelligence (AI) and Machine Learning (ML). However, new business requirements associated with the efficiency benefits of digitalization are forcing increased connectivity between IT and OT networks, thereby increasing the attack surface and hence the cyber risk. Cyber threats are on the rise and securing industrial networks are challenging with the shortage of human resource in OT field, with more inclination to IT/OT convergence and the attackers deploy various hi-tech methods to intrude the control systems nowadays. We have developed an innovative real-time ICS cyber test kit to obtain the OT industrial network traffic data with various industrial attack vectors. In this paper, we have introduced the industrial datasets generated from ICS test kit, which incorporate the cyber- physical system of industrial operations. These datasets with a normal baseline along with different industrial hacking scenarios are analyzed for research purposes. Metadata is obtained from Deep packet inspection (DPI) of flow properties of network packets. DPI analysis provides more visibility into the contents of OT traffic based on communication protocols. The advancement in technology has led to the utilization of machine learning/artificial intelligence capability in IDS ICS SCADA. The industrial datasets are pre-processed, profiled and the abnormality is analyzed with DPI. The processed metadata is normalized for the easiness of algorithm analysis and modelled with machine learning-based latest deep learning ensemble LSTM algorithms for anomaly detection. The deep learning approach has been used nowadays for enhanced OT IDS performances.

Item Type:	Conference or Workshop Item (Invited Papers)
Additional Information:	6727/90597
Uncontrolled Keywords:	Operational technology, Industrial control system, Deep packet inspection, Intrusion detection system, Anomaly detection, Machine learning, Deep learning.
Subjects:	T Technology > TK Electrical engineering. Electronics Nuclear engineering
Kulliyyahs/Centres/Divisions/Institutes (Can select more than one option. Press CONTROL button):	Kulliyyah of Engineering > Department of Electrical and Computer Engineering Kulliyyah of Engineering
Depositing User:	Dr. Mohamed Hadi Habaebi
Date Deposited:	21 Jul 2021 11:58
Last Modified:	17 Sep 2021 15:53
URI:	http://irep.iium.edu.my/id/eprint/90597

Actions (login required)

View Item