Combining ensemble methods and social network metrics for improving accuracy of OCSVM on intrusion detection in SCADA systems

被引：56

作者：

Maglaras, Leandros A. ^{[1
]}

Jiang, Jianmin ^{[2
]}

Cruz, Tiago J. ^{[3
]}

机构：

[1] De Montfort Univ, Sch Comp Sci & Informat, Leicester, Leics, England

[2] Univ Surrey, Dept Comp, Guildford, Surrey, England

[3] Univ Coimbra, Dept Informat Engn, P-3000 Coimbra, Portugal

来源：

JOURNAL OF INFORMATION SECURITY AND APPLICATIONS | 2016年 / 30卷

关键词：

OCSVM; Intrusion detection; SCADA systems; Social analysis; CHALLENGES;

D O I：

10.1016/j.jisa.2016.04.002

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

Modern Supervisory Control and Data Acquisition (SCADA) systems used by the electric utility industry to monitor and control electric power generation, transmission and distribution are recognized today as critical components of the electric power delivery infrastructure. SCADA systems are large, complex and incorporate increasing numbers of widely distributed components. The presence of a real time intrusion detection mechanism, which can cope with different types of attacks, is of great importance in order to defend a system against cyber attacks. This defense mechanism must be distributed, cheap and above all accurate, since false positive alarms or mistakes regarding the origin of the intrusion mean severe costs for the system. Recently an integrated detection mechanism, namely IT-OCSVM, was proposed, which is distributed in a SCADA network as a part of a distributed intrusion detection system (DIDS), providing accurate data about the origin and the time of an intrusion. In this paper we also analyze the architecture of the integrated detection mechanism and we perform extensive simulations based on real cyber attacks in a small SCADA testbed in order to evaluate the performance of the proposed mechanism. (C) 2016 Elsevier Ltd. All rights reserved.

引用

页码：15 / 26

页数：12

共 26 条

[11] Misbehavior detection in wireless mesh networks [J].

Hamid, Md. Abdul ;

Islam, Md. Shariful ;

Hong, Choong Seon .

10TH INTERNATIONAL CONFERENCE ON ADVANCED COMMUNICATION TECHNOLOGY, VOLS I-III: INNOVATIONS TOWARD FUTURE NETWORKS AND SERVICES, 2008, :1167-1169

[12] Anomaly Detection via One Class SVM for Protection of SCADA Systems [J].

Jiang, Jianmin ;

Yasakethu, Lasith .

2013 INTERNATIONAL CONFERENCE ON CYBER-ENABLED DISTRIBUTED COMPUTING AND KNOWLEDGE DISCOVERY (CYBERC), 2013, :82-88

[13] Ensemble with neural networks for bankruptcy prediction [J].

Kim, Myoung-Jong ;

Kang, Dae-Ki .

EXPERT SYSTEMS WITH APPLICATIONS, 2010, 37 (04) :3373-3379

[14] Diversity measures for one-class classifier ensembles [J].

Krawczyk, Bartosz ;

Wozniak, Michal .

NEUROCOMPUTING, 2014, 126 :36-44

[15]

Lazarevic A, 2003, SIAM PROC S, P25

[16] Integrated OCSVM mechanism for intrusion detection in SCADA systems [J].

Maglaras, Leandros A. ;

Jiang, Jianmin ;

Cruz, Tiago .

ELECTRONICS LETTERS, 2014, 50 (25) :1935-1936

[17]

Maglaras LA, 2014, 2014 SCIENCE AND INFORMATION CONFERENCE (SAI), P626, DOI 10.1109/SAI.2014.6918252

[18] Security and Privacy Challenges in the Smart Grid [J].

McDaniel, Patrick ;

McLaughlin, Stephen .

IEEE SECURITY & PRIVACY, 2009, 7 (03) :75-77

[19] Combining One-Class Classifiers via Meta Learning [J].

Menahem, Eitan ;

Rokach, Lior ;

Elovici, Yuval .

PROCEEDINGS OF THE 22ND ACM INTERNATIONAL CONFERENCE ON INFORMATION & KNOWLEDGE MANAGEMENT (CIKM'13), 2013, :2435-2440

[20]

Shieh AD, 2009, LECT NOTES COMPUT SC, V5519, P181, DOI 10.1007/978-3-642-02326-2_19

← 1 2 3 →