Add-on anomaly threshold technique for improving unsupervised intrusion detection on SCADA data
Supervisory control and data acquisition (SCADA) systems monitor and supervise our daily infrastructure systems and industrial processes. Hence, the security of the information systems of critical infrastructures cannot be overstated. The effectiveness of unsupervised anomaly detection approaches is...
Saved in:
| Main Authors: | , , , , , , , , |
|---|---|
| Format: | Article |
| Published: |
MDPI AG
2020
|
| Online Access: | https://www.scopus.com/inward/record.uri?eid=2-s2.0-85086671739&doi=10.3390%2felectronics9061017&partnerID=40&md5=43974677e7dfc31730cf9391daef7321 http://eprints.utp.edu.my/23412/ |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| Institution: | Universiti Teknologi Petronas |
| Summary: | Supervisory control and data acquisition (SCADA) systems monitor and supervise our daily infrastructure systems and industrial processes. Hence, the security of the information systems of critical infrastructures cannot be overstated. The effectiveness of unsupervised anomaly detection approaches is sensitive to parameter choices, especially when the boundaries between normal and abnormal behaviours are not clearly distinguishable. Therefore, the current approach in detecting anomaly for SCADA is based on the assumptions by which anomalies are defined; these assumptions are controlled by a parameter choice. This paper proposes an add-on anomaly threshold technique to identify the observations whose anomaly scores are extreme and significantly deviate from others, and then such observations are assumed to be �abnormal�. The observations whose anomaly scores are significantly distant from �abnormal� ones will be assumed as �normal�. Then, the ensemble-based supervised learning is proposed to find a global and efficient anomaly threshold using the information of both �normal�/�abnormal� behaviours. The proposed technique can be used for any unsupervised anomaly detection approach to mitigate the sensitivity of such parameters and improve the performance of the SCADA unsupervised anomaly detection approaches. Experimental results confirm that the proposed technique achieved a significant improvement compared to the state-of-the-art of two unsupervised anomaly detection algorithms. © 2020 by the authors. Licensee MDPI, Basel, Switzerland. |
|---|