Industrial network intrusion detection in open-set scenarios
Wei Yu,Zhixiang Chen,Hui Wang,Zeyu Miao,Dake Zhong
DOI: https://doi.org/10.1007/s10207-024-00949-2
2024-12-08
International Journal of Information Security
Abstract:With the widespread use of the industrial internet, industrial control systems (ICS) are increasingly vulnerable to network intrusions, making their security challenges more prominent. Current intrusion detection methods primarily focus on closed-set scenarios; however, in open-set scenarios, numerous unknown classes of intrusions lead to poor detection performance. To address this issue, this paper proposes a novel open-set industrial network intrusion detection method. The method begins with a feature extractor, termed GPL (BiGRU-PL), which integrates bidirectional gated recurrent units (BiGRU) and prototype learning (PL) through joint training. This model is trained using Distance-Based Cross-Entropy (DCE) loss and Prototype Loss, effectively enhancing intra-class compactness for known classes in the open set, increasing inter-class distance, and achieving separability between unknown and known classes in the feature space. Following this, the Weibull model is employed to construct an Extreme Value Theory (EVT) discriminant module that fits each known class and calculates an outlier probability threshold for each known class. Finally, the method computes the outlier probability value of each input sample for each known category and compares the test sample's outlier probability value against the threshold to recognize unknown classes. Experimental results on the CICIDS2017 dataset and Gas Pipeline dataset demonstrate the effectiveness of the proposed method. The method achieves high accuracy in recognizing known classes. Additionally, it effectively identifies unknown class intrusions in open-set scenarios with varying degrees of openness.
computer science, information systems, theory & methods, software engineering