A Comparative Study of AI-based Intrusion Detection Techniques in Critical Infrastructures

Safa Otoum,Burak Kantarci,Hussein Mouftah
DOI: https://doi.org/10.48550/arXiv.2008.00088
2020-07-25
Abstract:Volunteer computing uses Internet-connected devices (laptops, PCs, smart devices, etc.), in which their owners volunteer them as storage and computing power resources, has become an essential mechanism for resource management in numerous applications. The growth of the volume and variety of data traffic in the Internet leads to concerns on the robustness of cyberphysical systems especially for critical infrastructures. Therefore, the implementation of an efficient Intrusion Detection System for gathering such sensory data has gained vital importance. In this paper, we present a comparative study of Artificial Intelligence (AI)-driven intrusion detection systems for wirelessly connected sensors that track crucial applications. Specifically, we present an in-depth analysis of the use of machine learning, deep learning and reinforcement learning solutions to recognize intrusive behavior in the collected traffic. We evaluate the proposed mechanisms by using KD'99 as real attack data-set in our simulations. Results present the performance metrics for three different IDSs namely the Adaptively Supervised and Clustered Hybrid IDS (ASCH-IDS), Restricted Boltzmann Machine-based Clustered IDS (RBC-IDS) and Q-learning based IDS (QL-IDS) to detect malicious behaviors. We also present the performance of different reinforcement learning techniques such as State-Action-Reward-State-Action Learning (SARSA) and the Temporal Difference learning (TD). Through simulations, we show that QL-IDS performs with 100% detection rate while SARSA-IDS and TD-IDS perform at the order of 99.5%.
Networking and Internet Architecture,Distributed, Parallel, and Cluster Computing,Machine Learning
What problem does this paper attempt to address?
The key problem that this paper attempts to solve is to improve the efficiency and reliability of the intrusion detection system (IDS) of wireless sensor networks (WSN) in critical infrastructures. Specifically, the paper identifies and evaluates the performance of different artificial intelligence (AI) - driven intrusion detection techniques, such as machine learning, deep learning and reinforcement learning methods, in detecting malicious behaviors by comparison. The paper uses the KDD'99 data set for simulation tests to evaluate three different intrusion detection systems (IDS): Adaptive Supervised and Clustering Hybrid IDS (ASCH - IDS), Restricted Boltzmann Machine - based Clustering IDS (RBC - IDS) and Q - learning - based IDS (QL - IDS). Through these evaluations, the paper aims to provide an efficient and reliable intrusion detection solution for critical infrastructures, especially for wireless - connected sensor networks that are used to track important applications and services.