Advancing IoT Cybersecurity: Adaptive Threat Identification with Deep Learning in Cyber-Physical Systems
Received: 27 January 2024 | Revised: 16 February 2024 | Accepted: 18 February 2024 | Online: 2 April 2024
Corresponding author: C. Atheeq
Abstract
Securing Internet of Things (IoT)-enabled Cyber-Physical Systems (CPSs) can be challenging because security solutions intended for typical IT/OT systems may not be as effective in a CPS setting. The goal of this study is to create a mechanism for identifying and attributing two-level ensemble attacks that are specifically designed for use against Industrial Control Systems (ICSs). An original ensemble deep representation learning model is combined with decision tree algorithm to identify assaults on unbalanced ICS environments at the first level. An attack attribution network, which constitutes a collection of deep neural networks, is formed at the second level. The proposed model is tested using real-world datasets, notably those pertaining to water purification and gas pipelines. The results demonstrate that the proposed strategy outperforms other strategies with comparable computing complexity and that the recommended model outperforms the existing mechanisms.
Keywords:
cyber-attacks, deep learning, threat detection, industrial control system, industrial IoT, cyber-physical systemsDownloads
References
F. Zhang, H. A. D. E. Kodituwakku, J. W. Hines, and J. Coble, "Multilayer Data-Driven Cyber-Attack Detection System for Industrial Control Systems Based on Network, System, and Process Data," IEEE Transactions on Industrial Informatics, vol. 15, no. 7, pp. 4362–4369, Jul. 2019.
R. Ma, P. Cheng, Z. Zhang, W. Liu, Q. Wang, and Q. Wei, "Stealthy Attack Against Redundant Controller Architecture of Industrial Cyber-Physical System," IEEE Internet of Things Journal, vol. 6, no. 6, pp. 9783–9793, Sep. 2019.
E. Nakashima, "Foreign hackers targeted U.S. water plant in apparent malicious cyber attack, expert says," Washington Post, Jun. 30, 2023. https://www.washingtonpost.com/blogs/checkpoint-washington/post/foreign-hackers-broke-into-illinois-water-plant-control-system-industry-expert-says/2011/11/18/gIQAgmTZYN_blog.html.
G. Falco, C. Caldera, and H. Shrobe, "IIoT Cybersecurity Risk Modeling for SCADA Systems," IEEE Internet of Things Journal, vol. 5, no. 6, pp. 4486–4495, Dec. 2018.
J. Yang, C. Zhou, S. Yang, H. Xu, and B. Hu, "Anomaly Detection Based on Zone Partition for Security Protection of Industrial Cyber-Physical Systems," IEEE Transactions on Industrial Electronics, vol. 65, no. 5, pp. 4257–4267, May 2018.
S. A. Alshaya, "IoT Device Identification and Cybersecurity: Advancements, Challenges, and an LSTM-MLP Solution," Engineering, Technology & Applied Science Research, vol. 13, no. 6, pp. 11992–12000, Dec. 2023.
S. Ponomarev and T. Atkison, "Industrial Control System Network Intrusion Detection by Telemetry Analysis," IEEE Transactions on Dependable and Secure Computing, vol. 13, no. 2, pp. 252–260, Mar. 2016.
J. F. Clemente, "No cyber security for critical energy infrastructure," Ph.D. dissertation, Naval Postgraduate School, Monterey, CA, USA, 2018.
C. Bellinger, S. Sharma, and N. Japkowicz, "One-Class versus Binary Classification: Which and When?," in 11th International Conference on Machine Learning and Applications, Boca Raton, FL, USA, Dec. 2012, vol. 2, pp. 102–106.
M. A. Lateef, C. Atheeq, M. A. Rahman, and M. A. Faizan, "Data Aegis Using Chebyshev Chaotic Map-Based Key Authentication Protocol," in Intelligent Manufacturing and Energy Sustainability, A. R. Manchuri, D. Marla, and V. V. Rao, Eds. New York, NY, USA: Springer, 2023, pp. 187–195.
M. M. N. Aboelwafa, K. G. Seddik, M. H. Eldefrawy, Y. Gadallah, and M. Gidlund, "A Machine-Learning-Based Technique for False Data Injection Attacks Detection in Industrial IoT," IEEE Internet of Things Journal, vol. 7, no. 9, pp. 8462–8471, Sep. 2020.
W. Yan, L. K. Mestha, and M. Abbaszadeh, "Attack Detection for Securing Cyber Physical Systems," IEEE Internet of Things Journal, vol. 6, no. 5, pp. 8471–8481, Oct. 2019.
M. A. Alqarni and S. H. Chauhdary, "A Security Scheme for Statistical Anomaly Detection and the Mitigation of Rank Attacks in RPL Networks (IoT Environment)," Engineering, Technology & Applied Science Research, vol. 13, no. 6, pp. 12409–12414, Dec. 2023.
T. K. Das, S. Adepu, and J. Zhou, "Anomaly detection in Industrial Control Systems using Logical Analysis of Data," Computers & Security, vol. 96, Sep. 2020, Art. no. 101935.
Y. Bengio, A. Courville, and P. Vincent, "Representation Learning: A Review and New Perspectives," IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 35, no. 8, pp. 1798–1828, Aug. 2013.
M. Zolanvari, M. A. Teixeira, L. Gupta, K. M. Khan, and R. Jain, "Machine Learning-Based Network Vulnerability Analysis of Industrial Internet of Things," IEEE Internet of Things Journal, vol. 6, no. 4, pp. 6822–6834, Aug. 2019.
I. A. Khan, D. Pi, Z. U. Khan, Y. Hussain, and A. Nawaz, "HML-IDS: A Hybrid-Multilevel Anomaly Prediction Approach for Intrusion Detection in SCADA Systems," IEEE Access, vol. 7, pp. 89507–89521, 2019.
C. Atheeq and M. M. A. Rabbani, "Mutually authenticated key agreement protocol based on chaos theory in integration of internet and MANET," International Journal of Computer Applications in Technology, vol. 56, no. 4, pp. 309–318, Jan. 2017.
R. Alsulami, B. Alqarni, R. Alshomrani, F. Mashat, and T. Gazdar, "IoT Protocol-Enabled IDS based on Machine Learning," Engineering, Technology & Applied Science Research, vol. 13, no. 6, pp. 12373–12380, Dec. 2023.
J. J. Q. Yu, Y. Hou, and V. O. K. Li, "Online False Data Injection Attack Detection With Wavelet Transform and Deep Neural Networks," IEEE Transactions on Industrial Informatics, vol. 14, no. 7, pp. 3271–3280, Jul. 2018.
A. Cook, A. Nicholson, H. Janicke, L. Maglaras, and R. Smith, "Attribution of Cyber Attacks on Industrial Control Systems," EAI Endorsed Transactions on Industrial Networks and Intelligent Systems, vol. 3, no. 7, Apr. 2016, Art. no. e3.
N. A. Alsharif, S. Mishra, and M. Alshehri, "IDS in IoT using Machine Learning and Blockchain," Engineering, Technology & Applied Science Research, vol. 13, no. 4, pp. 11197–11203, Aug. 2023.
L. Maglaras, M. A. Ferrag, A. Derhab, M. Mukherjee, H. Janicke, and S. Rallis, "Threats, Countermeasures and Attribution of Cyber Attacks on Critical Infrastructures," EAI Endorsed Transactions on Security and Safety, vol. 5, no. 16, Oct. 2018, Art. no. e1.
C. Atheeq and M. M. A. Rabbani, "CACK—A Counter Based Authenticated ACK to Mitigate Misbehaving Nodes from MANETs," Recent Advances in Computer Science and Communications (Formerly: Recent Patents on Computer Science), vol. 14, no. 3, pp. 837–847, Apr. 2021.
M. Alaeiyan, A. Dehghantanha, T. Dargahi, M. Conti, and S. Parsa, "A Multilabel Fuzzy Relevance Clustering System for Malware Attack Attribution in the Edge Layer of Cyber-Physical Networks," ACM Transactions on Cyber-Physical Systems, vol. 4, no. 3, Nov. 2020, Art. no. 31.
U. Noor, Z. Anwar, T. Amjad, and K.-K. R. Choo, "A machine learning-based FinTech cyber threat attribution framework using high-level indicators of compromise," Future Generation Computer Systems, vol. 96, pp. 227–242, Jul. 2019.
Downloads
How to Cite
License
Copyright (c) 2024 C. Atheeq, Ruhiat Sultana, Syeda Asfiya Sabahath, Murtuza Ahmed Khan Mohammed
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain the copyright and grant the journal the right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) after its publication in ETASR with an acknowledgement of its initial publication in this journal.
