Logo

Add-on anomaly threshold technique for improving unsupervised intrusion detection on SCADA data

Almalawi, A. and Fahad, A. and Tari, Z. and Khan, A.I. and Alzahrani, N. and Bakhsh, S.T. and Alassafi, M.O. and Alshdadi, A. and Qaiyum, S. (2020) Add-on anomaly threshold technique for improving unsupervised intrusion detection on SCADA data. Electronics (Switzerland), 9 (6). pp. 1-20.

Full text not available from this repository.

Official URL: https://www.scopus.com/inward/record.uri?eid=2-s2....

Abstract

Supervisory control and data acquisition (SCADA) systems monitor and supervise our daily infrastructure systems and industrial processes. Hence, the security of the information systems of critical infrastructures cannot be overstated. The effectiveness of unsupervised anomaly detection approaches is sensitive to parameter choices, especially when the boundaries between normal and abnormal behaviours are not clearly distinguishable. Therefore, the current approach in detecting anomaly for SCADA is based on the assumptions by which anomalies are defined; these assumptions are controlled by a parameter choice. This paper proposes an add-on anomaly threshold technique to identify the observations whose anomaly scores are extreme and significantly deviate from others, and then such observations are assumed to be �abnormal�. The observations whose anomaly scores are significantly distant from �abnormal� ones will be assumed as �normal�. Then, the ensemble-based supervised learning is proposed to find a global and efficient anomaly threshold using the information of both �normal�/�abnormal� behaviours. The proposed technique can be used for any unsupervised anomaly detection approach to mitigate the sensitivity of such parameters and improve the performance of the SCADA unsupervised anomaly detection approaches. Experimental results confirm that the proposed technique achieved a significant improvement compared to the state-of-the-art of two unsupervised anomaly detection algorithms. © 2020 by the authors. Licensee MDPI, Basel, Switzerland.

Item Type:Article
Impact Factor:cited By 3
ID Code:23412
Deposited By: Ms Sharifah Fahimah Saiyed Yeop
Deposited On:19 Aug 2021 07:22
Last Modified:19 Aug 2021 07:22

Repository Staff Only: item control page