Agnostic CH-DT Technique for SCADA Network High-Dimensional Data-Aware Intrusion Detection System

Abstract

The pervasiveness in the Industrial Internet of Things (IIoT) due to the application of supervisory control and data acquisition (SCADA) has led to the growth of heterogeneous sensor data, thereby increasing the risk of intrusions and attacks. The existence and effect of intruders and their innovative attack techniques are on the rise. Existing intrusion detection systems (IDSs) tend to be computationally expensive with this form of data due to the presence of noise. In real-time domains, available methods lag, necessitating additional research into effective feature extraction schemes, which is fundamental in machine learning (ML) for time exigency. This study, in a comparative analysis of some feature selection techniques (FS), proposes a combination of an efficient ML classifier and an agnostic FS scheme for attack detection and classification in a real-time SCADA network. The flexibility and interoperability of the proposed approach resolve the computational complexity of vulnerability detection schemes while reducing false alarm rates (FARs) and overall model execution time. With the view of an online preprocessing, the proposed technique is phased, thus: 1) data preparatory consisting of data cleansing and normalization followed by 2) the combination of a prepruned decision tree (DT) algorithm and an agnostic chi-square FS approach built to obtain an optimal subset of data features for efficient IDS; and 3) evaluation of proposed agnostic DT-CH and other FS candidates for anomaly detection.