On the Performance of Isolation Forest and Multi Layer Perceptron for Anomaly Detection in Industrial Control Systems Networks
On the Performance of Isolation Forest and Multi Layer Perceptron for Anomaly Detection in Industrial Control Systems Networks
复制标题
DOI：
10.1109/iotsms53705.2021.9704986
复制
发表时间：
2021-12
期刊：
影响因子：
--
通讯作者：
Saja Alqurashi;H. Shirazi;I. Ray
中科院分区：
文献类型：
--
作者：
Saja Alqurashi;H. Shirazi;I. Ray
随着针对工业控制系统 (ICS) 网络的对抗性攻击越来越多，增强此类系统的安全性变得非常重要。尽管攻击预防策略通常已经到位，但防御所有攻击，尤其是零日攻击，变得不可能。需要入侵检测系统（IDS）来及时检测此类攻击。基于机器学习的检测系统，特别是深度学习算法，已经显示出有希望的结果并且优于其他方法。在本文中，我们研究了深度学习方法（即多层感知器（MLP））在检测 ICS 网络流量中的异常行为方面的功效。我们重点关注 ICS 网络中非常常见的侦察攻击。在此类攻击中，攻击者专注于收集有关目标网络的信息。为了评估我们的方法，我们将 MLP 与隔离森林 (i Forest)（一种统计机器学习方法）进行比较。我们提出的深度学习方法的准确率超过 99%，而 i Forest 只能达到 75%。这有助于增强使用深度学习技术进行异常检测的前景。
With an increasing number of adversarial attacks against Industrial Control Systems (ICS) networks, enhancing the security of such systems is invaluable. Although attack prevention strategies are often in place, protecting against all attacks, especially zero-day attacks, is becoming impossible. Intrusion Detection Systems (IDS) are needed to detect such attacks promptly. Machine learning-based detection systems, especially deep learning algorithms, have shown promising results and outperformed other approaches. In this paper, we study the efficacy of a deep learning approach, namely, Multi Layer Perceptron (MLP), in detecting abnormal behaviors in ICS network traffic. We focus on very common reconnaissance attacks in ICS networks. In such attacks, the adversary focuses on gathering information about the targeted network. To evaluate our approach, we compare MLP with isolation Forest (i Forest), a statistical machine learning approach. Our proposed deep learning approach achieves an accuracy of more than 99% while i Forest achieves only 75%. This helps to reinforce the promise of using deep learning techniques for anomaly detection.