AI summary · arXiv: 2202.11917v1 · cs.CR

Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations

Muhammad Azmi Umer, Khurum Nazir Junejo, Muhammad Taha Jilani, Aditya P. Mathur
Original paper · DOI 10.1016/j.ijcip.2022.100516 Submitted to arXiv on 24 Feb. 2022 Published in International Journal of Critical Infrastructure Protection (September 2022) License: NONEXCLUSIVE-DISTRIB 1.0

How to read this summary? Illustrated guide

The essentials

  • Machine learning methods are increasingly used to develop resilient Industrial Control Systems (ICS) against cyber-attacks.
  • Two key areas of focus for these methods are network-level intrusion detection and physical process anomaly detection.
  • Four types of machine learning methods are employed: supervised, semi-supervised, unsupervised, and reinforcement learning.
  • The survey examines relevant studies in the public domain and organizes them within a 7-dimensional space for comparison.
  • The target audience includes researchers, students, and practitioners interested in securing ICS using machine learning techniques.
  • Challenges associated with implementing these methods are identified, along with research gaps that need further investigation.
  • Recommendations are proposed to address these research gaps and enhance the effectiveness of intrusion and anomaly detection in ICS using machine learning.

Key points written by AI: they may contain errors, check them against the paper.

AI-generated keywords: Machine Learning ICS Intrusion Detection Anomaly Detection Cyber-attacks

Read further

  • Comprehensive Summary
  • Layman's Summary
  • Blog article
  • Original abstract
Methods from machine learning are being increasingly utilized to develop Industrial Control Systems (ICS) that are resilient to cyber-attacks. These methods primarily focus on two key areas: detecting intrusions at the network level by analyzing information obtained from network packets, and identifying anomalies at the physical process level by analyzing data that represents the system's physical behavior. This comprehensive survey delves into four types of machine learning methods employed for intrusion and anomaly detection in ICS: supervised, semi-supervised, unsupervised, and reinforcement learning. The survey extensively examines literature available in the public domain, meticulously selecting and analyzing relevant studies. To facilitate comparison, the selected literature is organized within a 7-dimensional space. The target audience for this survey includes researchers, students, and practitioners interested in understanding the application of machine learning techniques in securing ICS. Throughout the survey, various challenges associated with implementing these machine learning methods are identified as well as research gaps which are highlighted to provide insights into areas where further investigation is needed. Based on these findings, recommendations are proposed to address these research gaps and enhance the effectiveness of intrusion and anomaly detection in ICS using machine learning. Overall, this refined summary emphasizes the growing significance of applying machine learning approaches to design robust ICS capable of withstanding cyber-attacks. It underscores the importance of both network-level intrusion detection and physical process anomaly detection while providing a comprehensive overview of different types of machine learning methods used in this context. Additionally, it identifies challenges and research gaps which serve as a valuable resource for future studies aiming to improve upon existing techniques and fill knowledge voids in this field.

Was this synthesis useful?

Score: 0

Why do we need votes?

Votes are used to determine whether we need to re-run our summarizing tools. If the count reaches -10, our tools can be restarted.

Figures and plots

Ask about a figure by number or use its question button to request visual analysis. Up to two figures and four image panels per question. Values read from plots are approximate; check the original data.

AI assistant instructions?

Tools for this paper

Explain it differently 3 free rewrites left today
Save to a collection Group papers in collections to compare them, chat with them and export them. Create a free account Log in

Advanced tools Premium

For researchers who follow a field closely: citation alerts, journal-club slides, version comparison and Zotero export. Discover Premium

Zotero
Citation alerts Citation alerts guide

Papers around this one

See them on a map

Ranked by how close their title and abstract are to this paper’s. Select some to read them together.

Closest papers

  1. Very close
    Machine Learning Based Intrusion Detection Systems for IoT Applications
    Abhishek Verma, Virender Ranga · 2023 · Wireless Personal Communications, 111, 2287-2310 (2020) · AI summary available
    Abstract

    Internet of Things (IoT) and its applications are the most popular research areas at present. The characteristics of IoT on one side make it easily applicable to real-life applications, whereas on the other side expose it to cyber threats. Denial of Service (DoS) is one of the most catastrophic attacks against IoT. In this paper, we investigate the prospects of using machine learning classification algorithms for securing IoT against DoS attacks. A comprehensive study is carried on the classifiers which can advance the development of anomaly-based intrusion detection systems (IDSs). Performance assessment of classifiers is done in terms of prominent metrics and validation methods. Popular da…

  2. Close
    Shallow and Deep Networks Intrusion Detection System: A Taxonomy and Survey
    Elike Hodo, Xavier Bellekens, Andrew Hamilton et al. · 2017 · Cryptography and Security · AI summary available
    Abstract

    Intrusion detection has attracted a considerable interest from researchers and industries. The community, after many years of research, still faces the problem of building reliable and efficient IDS that are capable of handling large quantities of data, with changing patterns in real time situations. The work presented in this manuscript classifies intrusion detection systems (IDS). Moreover, a taxonomy and survey of shallow and deep networks intrusion detection systems is presented based on previous and current works. This taxonomy and survey reviews machine learning techniques and their performance in detecting anomalies. Feature selection which influences the effectiveness of machine lear…

  3. Close
    Survey of Machine Learning Based Intrusion Detection Methods for Internet of Medical Things
    Ayoub Si-Ahmed, Mohammed Ali Al-Garadi, Narhimene Boustia · 2022 · Cryptography and Security · Not summarized yet
    Abstract

    The Internet of Medical Things (IoMT) has revolutionized the healthcare industry by enabling physiological data collection using sensors, which are transmitted to remote servers for continuous analysis by physicians and healthcare professionals. This technology offers numerous benefits, including early disease detection and automatic medication for patients with chronic illnesses. However, IoMT technology also presents significant security risks, such as violating patient privacy or exposing sensitive data to interception attacks due to wireless communication, which could be fatal for the patient. Additionally, traditional security measures, such as cryptography, are challenging to implement…

  4. Close
    SoK: Applying Machine Learning in Security - A Survey
    Heju Jiang, Jasvir Nagra, Parvez Ahammad · 2016 · Cryptography and Security · AI summary available
    Abstract

    The idea of applying machine learning(ML) to solve problems in security domains is almost 3 decades old. As information and communications grow more ubiquitous and more data become available, many security risks arise as well as appetite to manage and mitigate such risks. Consequently, research on applying and designing ML algorithms and systems for security has grown fast, ranging from intrusion detection systems(IDS) and malware classification to security policy management(SPM) and information leak checking. In this paper, we systematically study the methods, algorithms, and system designs in academic publications from 2008-2015 that applied ML in security domains. 98 percent of the survey…

  5. Close
    Intrusion Detection: A Deep Learning Approach
    Ishaan Shivhare, Joy Purohit, Vinay Jogani et al. · 2023 · Cryptography and Security · AI summary available
    Abstract

    Network intrusions are a significant problem in all industries today. A critical part of the solution is being able to effectively detect intrusions. With recent advances in artificial intelligence, current research has begun adopting deep learning approaches for intrusion detection. Current approaches for multi-class intrusion detection include the use of a deep neural network. However, it fails to take into account spatial relationships between the data objects and long term dependencies present in the dataset. The paper proposes a novel architecture to combat intrusion detection that has a Convolutional Neural Network (CNN) module, along with a Long Short Term Memory(LSTM) module and with…

  6. Close
    The Threat of Adversarial Attacks on Machine Learning in Network Security -- A Survey
    Olakunle Ibitoye, Rana Abou-Khamis, Ashraf Matrawy et al. · 2019 · Cryptography and Security · AI summary available
    Abstract

    Machine learning models have made many decision support systems to be faster, more accurate and more efficient. However, applications of machine learning in network security face more disproportionate threat of active adversarial attacks compared to other domains. This is because machine learning applications in network security such as malware detection, intrusion detection, and spam filtering are by themselves adversarial in nature. In what could be considered an arms race between attackers and defenders, adversaries constantly probe machine learning systems with inputs which are explicitly designed to bypass the system and induce a wrong prediction. In this survey, we first provide a taxo…

  7. Close
    Survey on the Usage of Machine Learning Techniques for Malware Analysis
    Daniele Ucci, Leonardo Aniello, Roberto Baldoni · 2017 · Cryptography and Security · AI summary available
    Abstract

    Coping with malware is getting more and more challenging, given their relentless growth in complexity and volume. One of the most common approaches in literature is using machine learning techniques, to automatically learn models and patterns behind such complexity, and to develop technologies for keeping pace with the speed of development of novel malware. This survey aims at providing an overview on the way machine learning has been used so far in the context of malware analysis. We systematize surveyed papers according to their objectives (i.e., the expected output, what the analysis aims to), what information about malware they specifically use (i.e., the features), and what machine lear…

  8. Close
    An Analytics Framework for Heuristic Inference Attacks against Industrial Control Systems
    Taejun Choi, Guangdong Bai, Ryan K L Ko et al. · 2021 · Cryptography and Security · AI summary available
    Abstract

    Industrial control systems (ICS) of critical infrastructure are increasingly connected to the Internet for remote site management at scale. However, cyber attacks against ICS - especially at the communication channels between humanmachine interface (HMIs) and programmable logic controllers (PLCs) - are increasing at a rate which outstrips the rate of mitigation. In this paper, we introduce a vendor-agnostic analytics framework which allows security researchers to analyse attacks against ICS systems, even if the researchers have zero control automation domain knowledge or are faced with a myriad of heterogenous ICS systems. Unlike existing works that require expertise in domain knowledge and …

How are these papers found?

We compare the title and abstract of this paper with those of every paper summarized on this site, and with the papers Semantic Scholar recommends, those it cites and those citing it (for a much-cited paper, its most recent citations and, from OpenAlex, the most cited ones). Among the prior work and the follow-ups, the papers that use each other in depth, a method it uses and the much-cited follow-ups come a little higher. The levels (very close, close, related) come from the similarity of the texts, not from a judgment of quality; * marks a paper without an abstract, compared by its title. The sentence under a paper is written by an AI from the two abstracts: check it in the papers. A paper marked not relevant by three readers leaves the list.

For now only among the papers summarized on this site: search again to add the prior work, the follow-ups and Semantic Scholar’s recommendations.

The previous summary was created more than a year ago and can be re-run (if necessary) by clicking on the Run button below.

Disclaimer: The AI-based summarization tool and virtual assistant provided on this website may not always provide accurate and complete summaries or responses. We encourage you to carefully review and evaluate the generated content to ensure its quality and relevance to your needs.