An Intrusion Detection Method for Industrial Control System Based on Machine Learning

The integration of communication networks and the internet industrial control in Industrial Control System (ICS) increases their vulnerability to cyber attacks, causing devastating outcomes. Traditional Intrusion Detection Systems (IDS) largely rely on predefined models are trained mostly specific which means traditional IDS cannot cope with unknown attacks. Additionally, most do not consider imbalanced nature ICS datasets, thus suffering from low accuracy high False Positive Rates when being put use. In this paper, we propose NCO–double-layer DIFF_RF–OPFYTHON intrusion detection method for ICS, consists NCO modules, double-layer DIFF_RF OPFYTHON modules. Detected traffic will be divided into three categories by module: known normal traffic. Then, attacks classified module according feature attack Finally, use improve model input enhance model. results show that proposed outperforms methods, such as XGboost SVM. is also considerable. dataset used paper reaches 98.13%. rates reach 98.21% 95.1%, respectively. Moreover, has achieved suitable other public datasets.