Cyberattack Detection in Critical Infrastructure and Supply Chains

TL;DR

This paper proposes an enhanced IDS using Dense Neural Networks and data augmentation techniques to detect zero-day cyberattacks in critical infrastructure, addressing data imbalance challenges for improved detection accuracy.

Contribution

It introduces a novel combination of DNN and data augmentation for better detection of unseen attacks in highly imbalanced network datasets.

Findings

Data augmentation improves detection accuracy on balanced datasets.

Imbalanced datasets pose challenges, leading to overfitting.

Synthetic Minority Oversampling helps but is insufficient for original imbalanced data.

Abstract

Cyberattack detection in Critical Infrastructure and Supply Chains has become challenging in Industry 4.0. Intrusion Detection Systems (IDS) are deployed to counter the cyberattacks. However, an IDS effectively detects attacks based on the known signatures and patterns, Zero-day attacks go undetected. To overcome this drawback in IDS, the integration of a Dense Neural Network (DNN) with Data Augmentation is proposed. It makes IDS intelligent and enables it to self-learn with high accuracy when a novel attack is encountered. The network flow captures datasets are highly imbalanced same as the real network itself. The Data Augmentation plays a crucial role in balancing the data. The balancing of data is challenging as the minority class is as low as 0.000004\% of the dataset, and the abundant class is higher than 80\% of the dataset. Synthetic Minority Oversampling Technique is used for balancing the data. However, higher accuracies are achieved with balanced test data, lower accuracies are noticeable with the original imbalanced test data suggesting overfitting. A comparison with state-of-the-art research using Synthetic Minority Oversampling Technique with Edited Nearest Neighbor shows the classification of classes remains poor for the original dataset. This suggests highly imbalanced datasets of network flow require a different method of data augmentation.