Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Cyberattack Detection in Critical Infrastructure and Supply Chains

Smita Khapre

TL;DR

The paper tackles the challenge of detecting cyberattacks in Critical Infrastructure and Supply Chains under Industry 4.0 by introducing two DNN-based IDS variants (IDS1 and IDS2) that pair a two-layer dense network with SMOTE-driven data balancing. It demonstrates that SMOTE-based augmentation improves minority-class detection on CICIDS-2017 but can lead to overfitting on the original imbalanced data, underscoring the need for more nuanced augmentation. IDS2 adds a Categorization Unit and double balancing to better manage hierarchical attack groups, achieving high categorization accuracy across seven categories and strong per-subclass performance, though certain classes like Web Attacks remain challenging. The study highlights the practical potential of hybrid neural architectures for robust IDS in critical infrastructure, while also calling for larger, more diverse datasets and alternative balancing methods to reliably detect zero-day threats in real-world networks.

Abstract

Cyberattack detection in Critical Infrastructure and Supply Chains has become challenging in Industry 4.0. Intrusion Detection Systems (IDS) are deployed to counter the cyberattacks. However, an IDS effectively detects attacks based on the known signatures and patterns, Zero-day attacks go undetected. To overcome this drawback in IDS, the integration of a Dense Neural Network (DNN) with Data Augmentation is proposed. It makes IDS intelligent and enables it to self-learn with high accuracy when a novel attack is encountered. The network flow captures datasets are highly imbalanced same as the real network itself. The Data Augmentation plays a crucial role in balancing the data. The balancing of data is challenging as the minority class is as low as 0.000004\% of the dataset, and the abundant class is higher than 80\% of the dataset. Synthetic Minority Oversampling Technique is used for balancing the data. However, higher accuracies are achieved with balanced test data, lower accuracies are noticeable with the original imbalanced test data suggesting overfitting. A comparison with state-of-the-art research using Synthetic Minority Oversampling Technique with Edited Nearest Neighbor shows the classification of classes remains poor for the original dataset. This suggests highly imbalanced datasets of network flow require a different method of data augmentation.

Cyberattack Detection in Critical Infrastructure and Supply Chains

TL;DR

The paper tackles the challenge of detecting cyberattacks in Critical Infrastructure and Supply Chains under Industry 4.0 by introducing two DNN-based IDS variants (IDS1 and IDS2) that pair a two-layer dense network with SMOTE-driven data balancing. It demonstrates that SMOTE-based augmentation improves minority-class detection on CICIDS-2017 but can lead to overfitting on the original imbalanced data, underscoring the need for more nuanced augmentation. IDS2 adds a Categorization Unit and double balancing to better manage hierarchical attack groups, achieving high categorization accuracy across seven categories and strong per-subclass performance, though certain classes like Web Attacks remain challenging. The study highlights the practical potential of hybrid neural architectures for robust IDS in critical infrastructure, while also calling for larger, more diverse datasets and alternative balancing methods to reliably detect zero-day threats in real-world networks.

Abstract

Cyberattack detection in Critical Infrastructure and Supply Chains has become challenging in Industry 4.0. Intrusion Detection Systems (IDS) are deployed to counter the cyberattacks. However, an IDS effectively detects attacks based on the known signatures and patterns, Zero-day attacks go undetected. To overcome this drawback in IDS, the integration of a Dense Neural Network (DNN) with Data Augmentation is proposed. It makes IDS intelligent and enables it to self-learn with high accuracy when a novel attack is encountered. The network flow captures datasets are highly imbalanced same as the real network itself. The Data Augmentation plays a crucial role in balancing the data. The balancing of data is challenging as the minority class is as low as 0.000004\% of the dataset, and the abundant class is higher than 80\% of the dataset. Synthetic Minority Oversampling Technique is used for balancing the data. However, higher accuracies are achieved with balanced test data, lower accuracies are noticeable with the original imbalanced test data suggesting overfitting. A comparison with state-of-the-art research using Synthetic Minority Oversampling Technique with Edited Nearest Neighbor shows the classification of classes remains poor for the original dataset. This suggests highly imbalanced datasets of network flow require a different method of data augmentation.
Paper Structure (20 sections, 1 equation, 11 figures)

This paper contains 20 sections, 1 equation, 11 figures.

Table of Contents

  1. Introduction
  2. Background
  3. Related Work
  4. Dataset
  5. Evaluation
  6. Approach
  7. Data Pre-processing: Balancing and Standardization
  8. IDS1
  9. Data Balancing
  10. Binary Unit
  11. Classification
  12. IDS2
  13. Double-Balancing of Data
  14. Categorization Unit
  15. Classification Unit
  16. ...and 5 more sections

Figures (11)

  • Figure 1: Class Distribution in CICIDS-2017 Dataset after missing values examples
  • Figure 2: CICIDS-2017 Before Balancing
  • Figure 3: CICIDS-2017 After Balancing
  • Figure 4: 2-Layer FC with Softmax Layer DNN for Attack Classification
  • Figure 5: IDS1: Proposed Design with Binary Classification
  • ...and 6 more figures