Model Based Intrusion Detection System Design And Evaluation

Author : Ahsan Al Zaki Khan
Publisher :
ISBN 13 :
Total Pages : 74 pages
Book Rating : 4.:/5 (128 download)

DOWNLOAD NOW!

Download or read book Intrusion Detection System Design and Performance Evaluation for SCADA Networks written by Ahsan Al Zaki Khan and published by . This book was released on 2019 with total page 74 pages. Available in PDF, EPUB and Kindle. Book excerpt: This thesis entails a research project to assess and evaluate the performance of various Machine Learning classifier designs for misuse intrusion detection for industrial SCADA networks. As an industrial representative case, the dataset for a gas pipeline setup in Mississippi State University's SCADA Laboratory is employed for the research study. The dataset consists of three attack groups which entails seven different attack classes or categories for the laboratory prototype of a gas pipeline SCADA network. The same dataset further provides signatures of 35 different types of sub-attacks which are related to those seven attack classes. A number feature extraction and multi-stage classifier designs leveraging binary and multiple classes are utilized to determine the best performing combination of feature set and classifier design. The overall study is presented in multiple sections each of which discusses a unique approach to preprocessing, feature extraction, dataset utilization for training and testing, and classifier selection and design. First study entailed design of two types of classifiers for each of the three attack groups, namely Response, Command, and Function. One type of classifier was binary: it considered records belonging to normal operation versus an attack group. Its decision was that the record being classified either indicated normal operation or pointed at an attack belonging to that group. The second classifier type considered normal records and specific attack labels for each group of attacks, and hence performed multi-category classification. Overall six different types of classifiers were developed: one binary and one multi-category for each of three attack groups. Only one type of Machine Learning algorithm from the set including naive Bayes, PART and Random Forest implementations in the Weka toolset was employed for each of six types resulting in eighteen different classification cases. Random Forest classifier performed consistently at a higher level compared to other two for nearly all cases. We then compared with two literature studies which used the same dataset and had their result published with the performance metrics we used. Our classifier designs outperformed in all cases. The second study entailed the design of three-stage machine learning classifier as a misuse intrusion detection system to detect specifically each of the 35 attack subclasses. The first stage of the classifier identified if a record belonged to normal operation or attack signature. If the record was found to belong to attack signature, then in the second stage, a multi-category design analyzed the attack to classify it into one of seven attack classes. Based on the identified attack class as determined by the output from the second stage classifier, the attack record was provided for a third stage sub-attack classification, where seven different classifiers were employed. The output from the third stage classifier identified the sub-attack type to which the record belonged. Performance of the multi-stage 35-attack sub-class classifier was compared to a single stage 35-attack sub-class classifier. The multi-stage classifier outperformed the single-stage classifier. Further comparison with compatible studies in the literature also indicated that the multi-stage classifier performed notably better. Simulation results of the overall study indicate that designs exploring specialization to domains or executing the classification in multiple stages are promising for problems where the features, collectively, may not have the needed discriminatory power to identify a specific class in the presence of tens of classes.