Robust Intrusion Detection for Industrial Control Systems Using Improved Autoencoder and Bayesian Gaussian Mixture Model
Machine learning-based intrusion detection systems are an effective way to cope with the increasing security threats faced by industrial control systems. Considering that it is hard and expensive to obtain attack data, it is more reasonable to develop a model trained with only normal data. However,...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2023-04-01
|
| Series: | Mathematics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2227-7390/11/9/2048 |
| _version_ | 1797602203808038912 |
|---|---|
| author | Chao Wang Hongri Liu Chao Li Yunxiao Sun Wenting Wang Bailing Wang |
| author_facet | Chao Wang Hongri Liu Chao Li Yunxiao Sun Wenting Wang Bailing Wang |
| author_sort | Chao Wang |
| collection | DOAJ |
| description | Machine learning-based intrusion detection systems are an effective way to cope with the increasing security threats faced by industrial control systems. Considering that it is hard and expensive to obtain attack data, it is more reasonable to develop a model trained with only normal data. However, both high-dimensional data and the presence of outliers in the training set result in efficiency degradation. In this research, we present a hybrid intrusion detection method to overcome these two problems. First, we created an improved autoencoder that incorporates the deep support vector data description (Deep SVDD) loss into the training of the autoencoder. Under the combination of Deep SVDD loss and reconstruction loss, the novel autoencoder learns a more compact latent representation from high-dimensional data. The density-based spatial clustering of applications with noise algorithm is then used to remove potential outliers in the training data. Finally, a Bayesian Gaussian mixture model is used to identify anomalies. It learns the distribution of the filtered training data and uses the probabilities to classify normal and anomalous samples. We conducted a series of experiments on two intrusion detection datasets to assess performance. The proposed model performs better than other baseline methods when dealing with high-dimensional and contaminated data. |
| first_indexed | 2024-03-11T04:13:41Z |
| format | Article |
| id | doaj.art-ea184eac2e98477fbc7b78b09cd7aaf6 |
| institution | Directory Open Access Journal |
| issn | 2227-7390 |
| language | English |
| last_indexed | 2024-03-11T04:13:41Z |
| publishDate | 2023-04-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Mathematics |
| spelling | doaj.art-ea184eac2e98477fbc7b78b09cd7aaf62023-11-17T23:19:19ZengMDPI AGMathematics2227-73902023-04-01119204810.3390/math11092048Robust Intrusion Detection for Industrial Control Systems Using Improved Autoencoder and Bayesian Gaussian Mixture ModelChao Wang0Hongri Liu1Chao Li2Yunxiao Sun3Wenting Wang4Bailing Wang5School of Computer Science and Technology, Harbin Institute of Technology, Weihai 264209, ChinaSchool of Computer Science and Technology, Harbin Institute of Technology, Weihai 264209, ChinaWeihai Cyberguard Technologies Co., Ltd., Weihai 264209, ChinaSchool of Computer Science and Technology, Harbin Institute of Technology, Weihai 264209, ChinaState Grid Shandong Electric Power Company, Electric Power Research Institute, Jinan 250003, ChinaSchool of Computer Science and Technology, Harbin Institute of Technology, Weihai 264209, ChinaMachine learning-based intrusion detection systems are an effective way to cope with the increasing security threats faced by industrial control systems. Considering that it is hard and expensive to obtain attack data, it is more reasonable to develop a model trained with only normal data. However, both high-dimensional data and the presence of outliers in the training set result in efficiency degradation. In this research, we present a hybrid intrusion detection method to overcome these two problems. First, we created an improved autoencoder that incorporates the deep support vector data description (Deep SVDD) loss into the training of the autoencoder. Under the combination of Deep SVDD loss and reconstruction loss, the novel autoencoder learns a more compact latent representation from high-dimensional data. The density-based spatial clustering of applications with noise algorithm is then used to remove potential outliers in the training data. Finally, a Bayesian Gaussian mixture model is used to identify anomalies. It learns the distribution of the filtered training data and uses the probabilities to classify normal and anomalous samples. We conducted a series of experiments on two intrusion detection datasets to assess performance. The proposed model performs better than other baseline methods when dealing with high-dimensional and contaminated data.https://www.mdpi.com/2227-7390/11/9/2048industrial control systemsnetwork securityintrusion detectionanomaly detectionautoencoder |
| spellingShingle | Chao Wang Hongri Liu Chao Li Yunxiao Sun Wenting Wang Bailing Wang Robust Intrusion Detection for Industrial Control Systems Using Improved Autoencoder and Bayesian Gaussian Mixture Model Mathematics industrial control systems network security intrusion detection anomaly detection autoencoder |
| title | Robust Intrusion Detection for Industrial Control Systems Using Improved Autoencoder and Bayesian Gaussian Mixture Model |
| title_full | Robust Intrusion Detection for Industrial Control Systems Using Improved Autoencoder and Bayesian Gaussian Mixture Model |
| title_fullStr | Robust Intrusion Detection for Industrial Control Systems Using Improved Autoencoder and Bayesian Gaussian Mixture Model |
| title_full_unstemmed | Robust Intrusion Detection for Industrial Control Systems Using Improved Autoencoder and Bayesian Gaussian Mixture Model |
| title_short | Robust Intrusion Detection for Industrial Control Systems Using Improved Autoencoder and Bayesian Gaussian Mixture Model |
| title_sort | robust intrusion detection for industrial control systems using improved autoencoder and bayesian gaussian mixture model |
| topic | industrial control systems network security intrusion detection anomaly detection autoencoder |
| url | https://www.mdpi.com/2227-7390/11/9/2048 |
| work_keys_str_mv | AT chaowang robustintrusiondetectionforindustrialcontrolsystemsusingimprovedautoencoderandbayesiangaussianmixturemodel AT hongriliu robustintrusiondetectionforindustrialcontrolsystemsusingimprovedautoencoderandbayesiangaussianmixturemodel AT chaoli robustintrusiondetectionforindustrialcontrolsystemsusingimprovedautoencoderandbayesiangaussianmixturemodel AT yunxiaosun robustintrusiondetectionforindustrialcontrolsystemsusingimprovedautoencoderandbayesiangaussianmixturemodel AT wentingwang robustintrusiondetectionforindustrialcontrolsystemsusingimprovedautoencoderandbayesiangaussianmixturemodel AT bailingwang robustintrusiondetectionforindustrialcontrolsystemsusingimprovedautoencoderandbayesiangaussianmixturemodel |