Hierarchical Online Intrusion Detection for SCADA Networks
This addresses security for SCADA infrastructure, which is critical for industrial control systems, but appears incremental as it builds on existing machine learning methods.
The authors tackled intrusion detection in SCADA networks by proposing a hierarchical online system (HOIDS) that uses machine learning with logistic regression and quasi-Newton optimization, achieving high detection rates with minimal network impact as demonstrated on KDD99 and industrial control datasets.
We propose a novel hierarchical online intrusion detection system (HOIDS) for supervisory control and data acquisition (SCADA) networks based on machine learning algorithms. By utilizing the server-client topology while keeping clients distributed for global protection, high detection rate is achieved with minimum network impact. We implement accurate models of normal-abnormal binary detection and multi-attack identification based on logistic regression and quasi-Newton optimization algorithm using the Broyden-Fletcher-Goldfarb-Shanno approach. The detection system is capable of accelerating detection by information gain based feature selection or principle component analysis based dimension reduction. By evaluating our system using the KDD99 dataset and the industrial control system dataset, we demonstrate that HOIDS is highly scalable, efficient and cost effective for securing SCADA infrastructures.