Lp-norms in One-Class Classification for Intrusion Detection in SCADA Systems
Résumé
The massive use of information and communication technologies in supervisory control and data acquisition (SCADA) systems opens new ways for carrying out cyberattacks against critical infrastructures relying on SCADA networks. The various vulnerabilities in these systems and the heterogeneity of cyberattacks make the task extremely difficult for traditional intrusion detection systems (IDS). Modeling cyberattacks has become nearly impossible and their potential consequences may be very severe. The primary objective of this work is to detect malicious intrusions once they have already bypassed traditional IDS and firewalls. This paper investigates the use of machine learning for intrusion detection in SCADA systems using one-class classification algorithms. Two approaches of one-class classification are investigated: 1) the support vector data description (SVDD); and 2) the kernel principle component analysis. The impact of the considered metric is examined in detail with the study of lp-norms in radial basis function (RBF) kernels. A heuristic is proposed to find an optimal choice of the bandwidth parameter in these kernels. Tests are conducted on real data with several types of cyberattacks.
Mots clés
cyberattacks modeling
firewalls
critical infrastructures
learning (artificial intelligence)
principal component analysis
one-class
cybersecurity
computer crime
IDS
intrusion detection systems
SCADA networks
one-class classification algorithms
radial basis function kernels
Machine learning
support vector machines
malicious intrusions detection
Kernel
RBF kernels
support vector data description
cyberattacks heterogeneity
SVDD
kernel principle component analysis
Intrusion detection
SCADA systems
radial basis function networks
systems vulnerabilities
pattern classification
bandwidth parameter
supervisory control and data acquisition systems
information and communication technologies
lp-norms
Optimization
kernel methods
\mbi lₚ -norms
one-class classification
supervisory control and data acquisition (SCADA) systems