Applying AI-based PoLA to the problem of early intrusion detection in ICS systems
type: CreativeWork
description: Our ability to protect essential infrastructures is critical to a nation’s civilised sustainability. This is supported by analogue and non-routable digital devices that control critical infrastructures (CNI). Routable Technology (IT), too, seeks to defend them and defeat disturbances. CNI investments are complex, large and yield long lead-time returns. Minor outages can pose existential threats to consumers of products or services supplied. Operators can rapidly incur major losses. Analysing CNI network traffic of an industrial control system (ICS) requires shared data. This is often reluctantly disclosed. Those actually available may be inappropriate for investigation or compromise reluctant donors in some way. The motivation to generate tailored ICS network traffic that eases its analysis becomes more evident, and the need to do it at budget more tangible. A near-fidelity PoL test bench is built comprising a data recording and analysis facility. A unique approach is applied using packet capture software, embedded within a development environment, to establish the core of an automated ICS network traffic recording system. This PoL infrastructure is used to test the project’s hypothesis.: The application of AI-based PoL Analysis to the problem of early intrusion in ICS systems can significantly improve the security resilience of those systems. The test bench uniquely automates the acquisition, conversion, and database storage of ICS TCP/IP traffic and fuses it with measurements of physical phenomena. Data Analytics (SQL) and Machine Learning (ML) techniques using Naïve Bernoulli, Gaussian, as well as KNearest Neighbours are then applied to identify exceptional conditions in time-series ICS data. Trained ML models, enriched with simple network attack scenarios, are applied to the test datasets. Anomaly binary classification then follows. Precision and recall performance of the ML tests implies acceptability. Nevertheless, due to overfitting, data fidelity enrichment …
abstract: Our ability to protect essential infrastructures is critical to a nation’s civilised sustainability. This is supported by analogue and non-routable digital devices that control critical infrastructures (CNI). Routable Technology (IT), too, seeks to defend them and defeat disturbances. CNI investments are complex, large and yield long lead-time returns. Minor outages can pose existential threats to consumers of products or services supplied. Operators can rapidly incur major losses. Analysing CNI network traffic of an industrial control system (ICS) requires shared data. This is often reluctantly disclosed. Those actually available may be inappropriate for investigation or compromise reluctant donors in some way. The motivation to generate tailored ICS network traffic that eases its analysis becomes more evident, and the need to do it at budget more tangible. A near-fidelity PoL test bench is built comprising a data recording and analysis facility. A unique approach is applied using packet capture software, embedded within a development environment, to establish the core of an automated ICS network traffic recording system. This PoL infrastructure is used to test the project’s hypothesis.: The application of AI-based PoL Analysis to the problem of early intrusion in ICS systems can significantly improve the security resilience of those systems. The test bench uniquely automates the acquisition, conversion, and database storage of ICS TCP/IP traffic and fuses it with measurements of physical phenomena. Data Analytics (SQL) and Machine Learning (ML) techniques using Naïve Bernoulli, Gaussian, as well as KNearest Neighbours are then applied to identify exceptional conditions in time-series ICS data. Trained ML models, enriched with simple network attack scenarios, are applied to the test datasets. Anomaly binary classification then follows. Precision and recall performance of the ML tests implies acceptability. Nevertheless, due to overfitting, data fidelity enrichment …
author: Donnelly, Peter
language: eng
date published: 2023
date modified: 2026-07-24T04:39:51Z
provider: University of South Wales
publisher: Networked Digital Library of Theses and Dissertations
type: WebPage
source organization: University of South Wales