Abstract:Industrial control systems are critical to the operation of industrial facilities, especially for critical infrastructures, such as refineries, power grids, and transportation systems. Similar to other information systems, a significant threat to industrial control systems is the attack from cyberspace---the offensive maneuvers launched by "anonymous" in the digital world that target computer-based assets with the goal of compromising a system's functions or probing for information. Owing to the importance of industrial control systems, and the possibly devastating consequences of being attacked, significant endeavors have been attempted to secure industrial control systems from cyberattacks. Among them are intrusion detection systems that serve as the first line of defense by monitoring and reporting potentially malicious activities. Classical machine-learning-based intrusion detection methods usually generate prediction models by learning modest-sized training samples all at once. Such approach is not always applicable to industrial control systems, as industrial control systems must process continuous control commands with limited computational resources in a nonstop way. To satisfy such requirements, we propose using online learning to learn prediction models from the controlling data stream. We introduce several state-of-the-art online learning algorithms categorically, and illustrate their efficacies on two typically used testbeds---power system and gas pipeline. Further, we explore a new cost-sensitive online learning algorithm to solve the class-imbalance problem that is pervasive in industrial intrusion detection systems. Our experimental results indicate that the proposed algorithm can achieve an overall improvement in the detection rate of cyberattacks in industrial control systems.

A Threat Recognition Solution of Edge Data Security in Industrial Internet

An Improved Support Vector Machine Attack Detection Algorithm for Industry Controls System

Industrial control network security situation awareness based on improved C-SVC

Process Stability Modeling and Attack Protection of Industrial Control System Based on Reverse Cloud Algorithm Model

An Industrial Network Intrusion Detection Algorithm Based on Multifeature Data Clustering Optimization Model

Research and Evaluation of Intelligent Threat Detection Under Industrial Internet

Leveraging Data Fitting and Trust Assessment to Improve the Security of Industrial Networks

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Autonomous Threat Response at the Edge Processing Level in the Industrial Internet of Things

A Malicious Node Identification Method Based on Edge Computing

Evaluating Dimensionality Reduction Methods for the Detection of Industrial IoT Attacks in Edge Computing

An improved intrusion detection method for IIoT using attention mechanisms, BiGRU, and Inception-CNN

An Intrusion Detection Method for Industrial Control System against Stealthy Attack

Detecting Cyberattacks in Industrial Control Systems Using Online Learning Algorithms

Research on Key Technology of Industrial Network Boundary Protection based on Endogenous Security

A multi-point collaborative DDoS defense mechanism for IIoT environment

A Situational Awareness Model for Edge Computing Devices

AI-based Identification of Most Critical Cyberattacks in Industrial Systems

Lightweight Trusted Identity Architecture Based on Industrial Internet Cloud Edge Collaboration Technology.

Blockchain based AI-enabled Industry 4.0 CPS Protection against Advanced Persistent Threat

Multi-Dimensional Security Indicator Design and Optimization for DDoS Detection in Edge Computing