Fast attack detection method for imbalanced data in industrial cyber-physical systems

• Autorzy: Huang Meng , Li Tao , Li Beibei , Zhang Nian , Huang Hanyuan

Identyfikatory

DOI

10.2478/jaiscr-2023-0017

• Języki publikacji: EN

Abstrakty

EN

Integrating industrial cyber-physical systems (ICPSs) with modern information technologies (5G, artificial intelligence, and big data analytics) has led to the development of industrial intelligence. Still, it has increased the vulnerability of such systems regarding cybersecurity. Traditional network intrusion detection methods for ICPSs are limited in identifying minority attack categories and suffer from high time complexity. To address these issues, this paper proposes a network intrusion detection scheme, which includes an information-theoretic hybrid feature selection method to reduce data dimensionality and the ALLKNN-LightGBM intrusion detection framework. Experimental results on three industrial datasets demonstrate that the proposed method outperforms four mainstream machine learning methods and other advanced intrusion detection techniques regarding accuracy, F-score, and run time complexity.

Słowa kluczowe

EN

intrusion detection system; industrial cyber-physical Systems; imbalanced data; all k-nearest neighbor; LightGBM

• Wydawca: University of Social Sciences
• Czasopismo: Journal of Artificial Intelligence and Soft Computing Research
• Rocznik: 2023
• Tom: Vol. 13, No. 4
• Strony: 229--245
• Opis fizyczny: Bibliogr. 52 poz., rys.

Twórcy

autor

Huang Meng

• School of Cyber Science and Engineering, Sichuan University, Chengdu, 610065, China
• College of Computer Science and Engineering, Chongqing Three Gorges University, Wanzhou, Chongqing, 404120, China

• https://orcid.org/0009-0000-9538-5932

autor

Li Tao

• School of Cyber Science and Engineering, Sichuan University, Chengdu, 610065, China

• https://orcid.org/0000-0002-5302-3180

autor

Li Beibei

• School of Cyber Science and Engineering, Sichuan University, Chengdu, 610065, China

• https://orcid.org/0000-0002-0485-1975

autor

Zhang Nian

• Departmnt of Electrical and Computer Engineering, University of the District of Columbia, Washington, DC 20008, USA

• https://orcid.org/0000-0003-1916-7719

autor

Huang Hanyuan

• School of Cyber Science and Engineering, Sichuan University, Chengdu, 610065, China

• https://orcid.org/0000-0002-9805-7560

Bibliografia

• [1] H. Kayan, M. Nunes, O. Rana, P. Burnap, C. Perera, Cybersecurity of industrial cyber-physical systems: a review, ACM Computing Surveys (CSUR), 54(11s), 2022, 1-35.
• [2] F. Tao, Q. Qi, New it driven service-oriented smart manufacturing: framework and characteristics, IEEE Transactions on Systems, Man, and Cybernetics: Systems, 49(1), 2019, 81-91.
• [3] L.D. Xu, E.L. Xu, L. Li, Industry 4.0: state of the art and future trends, International Journal of Production Research, 56(8), 2018, 2941-2962.
• [4] A. Corallo, M. Lazoi, M. Lezzi, A. Luperto, Cybersecurity awareness in the context of the Industrial Internet of Things: A systematic literature review, Computers in Industry, 137, 2022, 103614.
• [5] Leung M F, Jawaid A, Ip S W, et al, A portfolio recommendation system based on machine learning and big data analytics, Data Science in Finance and Economics, 3(2), 2023, 152-165.
• [6] Li C, Chen Y, Shang Y, A review of industrial big data for decision making in intelligent manufacturing, Engineering Science and Technology-an International Journal, 29, 2022, 101021.
• [7] D. Kushner, The real story of Stuxnet, IEEE Spectrum, 50(3), 2013, 48-53.
• [8] N. Sayfayn and S. Madnick, Cybersafety analysis of the maroochy shire sewage spill, MIT Interdisciplinary Consortium for Improving Critical Infrastructure Cybersecurity, 2017, 1-29.
• [9] K. Stouffer, V. Pillitteri, S. Lightman, M. Abrams, A. Hahn, Guide to industrial control systems (ICS) security. NIST special publication, 800(82), 2011, 16-16.
• [10] J. Yang, C. Zhou, S. Yang, H. Xu, B. Hu, Anomaly detection based on zone partition for security protection of industrial cyber-physical systems, IEEE Transactions on Industrial Electronics, 65(5), 2018, 4257-4267.
• [11] M. AL-Hawawreh, N. Moustafa, E. Sitnikova, Identification of malicious activities in industrial internet of things based on deep learning models, Journal of Information Security and Applications, 41, 2018, 1-11.
• [12] M. Zolanvari, M.A. Teixeira, L. Gupta, K.M. Khan, R. Jain, Machine learning-based network vulnerability analysis of industrial internet of things, IEEE Internet of Things Journal, 6(4), 2019, 6822-6834.
• [13] J. Liu, W. Zhang, T. Ma, Z. Tang, Y. Xie, W. Gui, J.P. Niyoyita, Toward security monitoring of industrial cyber-physical systems via hierarchically distributed intrusion detection, Expert Systems with Applications, 158, 2020, 113578.
• [14] Z. Hong, C. Yang, L. Yu, R-Print: a system residuals-based fingerprinting for attack detection in industrial cyber-physical systems, IEEE Transactions on Industrial Electronics, 68(11), 2021, 11458-11469.
• [15] M. Abdel-Basset, V. Chang, H. Hawash, R.K. Chakrabortty, M. Ryan, Deep-IFS: intrusion detection approach for industrial internet of things traffic in fog Environment, IEEE Transactions on Industrial Informatics. 17(11), 2021, 7704-7715.
• [16] J.B. Awotunde, C. Chakraborty, A.E. Adeniyi, Intrusion detection in industrial internet of things network-based on deep learning model with rulebased feature selection, Wireless Communications and Mobile Computing, 2021, 7154587.
• [17] D. Upadhyay, J. Manero, M. Zaman, S. Sampalli, Intrusion Detection in SCADA based power grids: recursive feature elimination model with majority vote ensemble algorithm, IEEE Transactions on Network Science and Engineering, 8(3), 2021, 2559-2574.
• [18] Y. Gao, J. Chen, H. Miao, B. Song, Y. Lu, W. Pan, Self-learning spatial distribution-based intrusion detection for industrial cyber-physical systems, IEEE Transactions on Computational Social Systems, 9(6), 2022, 1693-1702.
• [19] Z. Wang, Z. Li, D. He, S. Chan, A lightweight approach for network intrusion detection in industrial cyber-physical systems based on knowledge distillation and deep metric learning, Expert Systems with Applications, 206, 2022, 117671.
• [20] K. Yang, Y. Shi, Z. Yu, Q. Yang, A.K. Sangaiah, H. Zeng, Stacked one-class broad learning system for intrusion detection in industry 4.0, IEEE Transactions on Industrial Informatics, 19(1), 2023, 251-260.
• [21] W. Hao, T. Yang, Q. Yang, Hybrid statisticalmachine learning for real-time anomaly detection in industrial cyber-physical systems, IEEE Transactions on Automation Science and Engineering, 20(1), 2023, 32-46.
• [22] Y. Liu, Y. Peng, B. Wang, S. Yao, Z. Liu, Review on cyber-physical systems, IEEE/CAA Journal of Automatica Sinica, 4(1), 2017, 27-40.
• [23] D.G.S. Pivoto, L.F.F. de Almeida, R. da R. Righi, J.J.P.C. Rodrigues, A.B. Lugli, A.M. Alberti, Cyber-physical systems architectures for industrial internet of things applications in Industry 4.0: A literature review, Journal of Manufacturing Systems, 58, 2021, 176-192.
• [24] R.V. Yohanandhan, R.M. Elavarasan, P. Manoharan, L. Mihet-Popa, Cyber-physical power system (CPPS): a review on modeling, simulation, and analysis with cyber security applications, IEEE Access, 8, 2020, 151019-151064.
• [25] R. Qadeer, C. Murguia, C.M. Ahmed, J. Ruths, Multistage Downstream Attack Detection in a Cyber Physical System, In: S.K. Katsikas, F. Cuppens, N. Cuppens, C. Lambrinoudakis, C. Kalloniatis, J. Mylopoulos, A. Antn, S. Gritzalis (Eds.), Computer Security, Springer International Publishing, Cham, 2018, pp. 177-185.
• [26] Y. Wadhawan, C. Neuman, Evaluating resilience of gas pipeline systems under cyber-physical attacks: a function-based methodology, in: Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy, Association for Computing Machinery, New York, NY, USA, 2016, pp. 71-80.
• [27] J. Yao, X. Xu, X. Liu, MixCPS: Mixed time/eventtriggered architecture of cyber-physical systems, Proceedings of the IEEE, 104(5), 2016, 923-937.
• [28] Haibo He, E.A. Garcia, Learning from imbalanced data, IEEE Transactions on Knowledge and Data Engineering, 21(9), 2009, 1263-1284.
• [29] G. Haixiang, L. Yijing, J. Shang, G. Mingyun, H. Yuanyue, G. Bing, Learning from classimbalanced data: review of methods and applications, Expert Systems with Applications, 73, 2017, 220-239.
• [30] H. Kaur, H.S. Pannu, A.K. Malhi, A systematic review on imbalanced data challenges in machine learning: applications and solutions, ACM Computing Surveys (CSUR), 52(4), 2019, 1-36.
• [31] Y.-C. Chang, K.-H. Chang, G.-J. Wu, Application of eXtreme gradient boosting trees in the construction of credit risk assessment models for financial institutions, Applied Soft Computing, 73, 2018, 914-920.
• [32] J. Sun, H. Li, H. Fujita, B. Fu, W. Ai, Classimbalanced dynamic financial distress prediction based on Adaboost-SVM ensemble combined with SMOTE and time weighting, Information Fusion, 54, 2020, 128-144.
• [33] G. Brown, A. Pocock, M.-J. Zhao, and M. Lujan, Conditional likelihood maximisation: a unifying framework for information theoretic feature selection, The Journal of Machine Learning Research, 13(1), 2012, 27-66.
• [34] Yang H, Moody J, Feature selection based on joint mutual information, In: Proceedings of international ICSC symposium on advances in inteligent data analysis. Proceedings of international ICSC symposium on advances in intelligent data analysis. Rochester, NY: Citeseer, 1999, 23.
• [35] F. Fleuret, Fast binary feature selection with conditional mutual information, Journal of Machine Learning Research, 5(9), 2004, 1531-1555.
• [36] Souza F, Premebida C, Araujo R, High-order conditional mutual information maximization for dealing with high-order dependencies in feature selection, Pattern Recognition, 131, 2022, 108895.
• [37] Meyer P E, Bontempi G, On the use of variable complementarity for feature selection in cancer classification, in: Applications of Evolutionary Computing: EvoWorkshops 2006: EvoBIO, EvoCOMNET, EvoHOT, EvoIASP, EvoINTERACTION, EvoMUSART, and EvoSTOC, Budapest, Hungary, 2006, pp. 91-102.
• [38] D.L. Wilson, Asymptotic properties of nearest neighbor rules using edited data, IEEE Transactions on Systems, Man, and Cybernetics, SMC2(3), 1972, 408-421.
• [39] I. Tomek, An experiment with the edited nearestneighbor rule, IEEE Transactions on Systems, Man, and Cyberneticsn, SMC-6 (1976) 448-452.
• [40] Ke, G., Meng, Q., Finley, T., Wang, T., Chen, W., Ma, W., Ye. Q. W, Liu, T. Y., LightGBM: a highly efficient gradient boosting decision tree, Advances in neural information processing systems, 30, 2017, 3149-3157.
• [41] Morris T, Gao W, Industrial control system traffic data sets for intrusion detection research, in: Bayro-Corrochano E, Hancock E (eds) Progress in Pattern Recognition, Image Analysis, Computer Vision, and Applications. Springer International Publishing, Cham, 2014, pp. 65-78.
• [42] Goh J, Adepu S, Junejo KN, Mathur A, A dataset to support research in the design of secure water treatment systems, in: Havarneanu G, Setola R, Nassopoulos H, Wolthusen S (eds) Critical Information Infrastructures Security, 2017, 88-99.
• [43] Booij, T. M., Chiscop, I., Meeuwissen, E., Moustafa, N., den Hartog, F. T, ToN_IoT: the role of heterogeneity and the need for standardization of features and attack types in IoT network intrusion data sets, IEEE Internet of Things Journal, 9(1) 2022, 485-496.
• [44] W. Pei, B. Xue, M. Zhang, L. Shang, X. Yao, Q. Zhang, A survey on unbalanced classification: how can evolutionary computation help?, IEEE Transactions on Evolutionary Computation, 2023, 1-1.
• [45] Feng C, Li T, Chana D, Multi-level anomaly detection in industrial control systems via package signatures and LSTM networks, In: 2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), IEEE, 2017, pp.261-272.
• [46] J. Ling, Z. Zhu, Y. Luo, H. Wang, An intrusion detection method for industrial control systems based on bidirectional simple recurrent unit, Computers & Electrical Engineering, 91, 2021, 107049.
• [47] Y. Zhang, C. Yang, K. Huang, Y. Li, Intrusion detection of industrial internet-of-things based on reconstructed graph neural networks, IEEE Transactions on Network Science and Engineering, 2022, 1-12.
• [48] M. Abdelaty, R. Doriguzzi-Corin, D. Siracusa, DAICS: A deep learning solution for anomaly detection in industrial control systems, IEEE Transactions on Emerging Topics in Computing, 10(2), 2022, 1117-1129.
• [49] Abdelaty M, Doriguzzi-Corin R, Siracusa D, AADS: A noise-robust anomaly detection framework for industrial control systems, In: Information and Communications Security: 21st International Conference, Springer International Publishing, 2020, pp. 53-70.
• [50] Lin. Q, Adepu S, Verwer. S, Mathur. A, TABOR: A graphical model-based approach for anomaly detection in industrial control systems. In: Proceedings of the 2018 on Asia conference on computer and communications security, Association for Computing Machinery, 2018, pp. 525-536.
• [51] P. Kumar, G.P. Gupta, R. Tripathi, An ensemble learning and fog-cloud architecture-driven cyberattack detection framework for IoMT networks, Computer Communications, 166, 2021, 110-124.
• [52] M.S. Ahmad, S.M. Shah, Unsupervised ensemble based deep learning approach for attack detection in IoT network, Concurrency and Computation: Practice and Experience, 34(27), 2022, e7338.

Uwagi

Opracowanie rekordu ze środków MEiN, umowa nr SONP/SP/546092/2022 w ramach programu "Społeczna odpowiedzialność nauki" - moduł: Popularyzacja nauki i promocja sportu (2022-2023).