Application of Deep Learning on Cyber-Attack Detection and Identification in Industrial Control Systems

Abstract

Wide implementation of the communication networks in Industrial Control Systems (ICS) increases their vulnerability towards malicious attacks, which could cause potential devastating results. ICS use different control and network systems to monitor and control critical infrastructures through real-time monitoring to detect abnormal behaviors of the system. Unfortunately, traditional Intrusion Detection Systems (IDS) are mainly developed to support IT systems and are often not applicable in industrial environments. The main goal of this thesis is to analyze network traffic and sensory measurements in real- ICS and use different learning-based techniques to detect and locate cyber-attacks. To do so, several learning-based models, including an ensemble deep learning-based cyber-attack detection algorithm for imbalanced ICS datasets as well as a self-tuning and scalable deep learning and classification models for cyber-attack location identification, are proposed. The performance of the proposed models is evaluated using two real ICS datasets. The results show that the proposed models outperform state-of-the-art works in the literature, in f1-score, accuracy, and Matthews Correlation Coefficient (MCC).