Abstract:False alerts due to misconfigured or compromised intrusion detection systems (IDS) in industrial control system (ICS) networks can lead to severe economic and operational damage. However, research using deep learning to reduce false alerts often requires the physical and cyber sensor data to be trustworthy. Implicit trust is a major problem for artificial intelligence or machine learning (AI/ML) in cyber-physical system (CPS) security, because when these solutions are most urgently needed is also when they are most at risk (e.g., during an attack). To address this, the Inter-Domain Evidence theoretic Approach for Inference (IDEA-I) is proposed that reframes the detection problem as how to make good decisions given uncertainty. Specifically, an evidence theoretic approach leveraging Dempster-Shafer (DS) combination rules and their variants is proposed for reducing false alerts. A multi-hypothesis mass function model is designed that leverages probability scores obtained from supervised-learning classifiers. Using this model, a location-cum-domain-based fusion framework is proposed to evaluate the detector's performance using disjunctive, conjunctive, and cautious conjunctive rules. The approach is demonstrated in a cyber-physical power system testbed, and the classifiers are trained with datasets from Man-In-The-Middle attack emulation in a large-scale synthetic electric grid. For evaluating the performance, we consider plausibility, belief, pignistic, and general Bayesian theorem-based metrics as decision functions. To improve the performance, a multi-objective-based genetic algorithm is proposed for feature selection considering the decision metrics as the fitness function. Finally, we present a software application to evaluate the DS fusion approaches with different parameters and architectures.

A knowledge fusion based intrusion detection model

Multi-agent based hybrid Intrusion detection system

A Novel Intrusion Detection System Based on an Optimal Hybrid Kernel Extreme Learning Machine

A novel intrusion detection scheme for network-attached storage based on multisource information fusion

An Intrusion Detection Framework Based on Information Fusion

Intrusion sensor data fusion in an intelligent intrusion detection system architecture

Intrusion Detection System Model Based on Multi Detection Technology

Study of an IDS Alert Fusion and Correlation Model

Intelligent Advanced Attack Detection Technology based on Multi-modal Data Fusion

Data fusion and network intrusion detection systems

A integrated fuzzy-neural network intrusion detection model

A hybrid interpretable deep structure based on adaptive neuro-fuzzy inference system, decision tree, and K-means for intrusion detection

A Fusion Model for Network Threat Identification and Risk Assessment

Inter-Domain Fusion for Enhanced Intrusion Detection in Power Systems: An Evidence Theoretic and Meta-Heuristic Approach

A Hybrid Visualizing Approach Based on Adaptive Neuro-fuzzy Inference System, Decision Tree, and K-means for Intrusion Detection

Research of Intrusion Detection Based on Intelligence and Cooperation Technology

Research on Intrusion Scenarios Building Based on Multiple Hypothesis Tracking

Using Data Fusion for Awareness of Intrusion in Large-Scale Network

A Fusion Model Based on Dynamic Web Browsing Behavior Analysis for IoT Insider Threat Detection

Hybrid Intrusion Detection Based on Data Mining

Hybrid Intrusion Detection Method Based on CM-K-Means