Forget the Myth of the Air Gap: Machine Learning for Reliable Intrusion Detection in SCADA Systems

EAI Endorsed Transactions on Security and Safety

Rocio Lopez Perez¹  Florian Adamsky²  Ridha Soua³  Thomas Engel³ 

[1] CSC, University of Luxembourg, Luxembourg;Hof University, University of Applied Sciences, GermanySnT, University of Luxembourg, Luxembourg;SnT, University of Luxembourg, Luxembourg;

关键词: Critical Infrastructures;    SCADA;    Anomaly detection;    Machine Learning;    SVM;    Random Forest;    BLSTM;   

DOI  :  10.4108/eai.25-1-2019.159348

来源: DOAJ

【 摘 要 】

Since Critical Infrastructures (CIs) use systems and equipment that are separated by long distances, Supervisory Control And Data Acquisition (SCADA) systems are used to monitor their behaviour and to send commands remotely. For a long time, operator of CIs applied the air gap principle, a security strategy that physically isolates the control network from other communication channels. True isolation, however, is difficult nowadays due to the massive spread ofconnectivity: using open protocols and more connectivity opens new network attacks against CIs. To cope with this dilemma, sophisticated security measures are needed to address malicious intrusions, which are steadily increasing in number andvariety. However, traditional Intrusion Detection Systems (IDSs) cannot detect attacks that are not already present in their databases. To this end, we assess in this paper Machine Learning (ML) techniques for anomaly detection in SCADA systemsusing a real data set collected from a gas pipeline system and provided by the Mississippi State University (MSU). The contribution of this paper is two-fold: 1) The evaluation of four techniques for missing data estimation and two techniques for data normalization, 2) The performances of Support Vector Machine (SVM), Random Forest (RF), Bidirectional LongShort Term Memory (BLSTM) are assessed in terms of accuracy, precision, recall and F1 score for intrusion detection. Two cases are differentiated: binary and categorical classifications. Our experiments reveal that RF and BLSTM detect intrusions effectively, with an F1 score of respectively > 99% and > 96%.

【 授权许可】

Unknown