Ensemble Common Features Technique for Lightweight Intrusion Detection in Industrial Control System

Abstract

The integration of the Industrial Control System (ICS) with corporate intranets and the internet has exposed the previously isolated SCADA system to a wide range of cyber-attacks. Interestingly, the vulnerabilities in the Modbus protocol, with which the ICS communicates, make data obfuscation and communication between component entities less secure. In this work, we propose a Common Features Technique (CFT) for Lightweight Intrusion Detection based on an ensembled feature selection approach. Our Common Features Technique, which used fewer features, was able to detect intrusion at the same level as models using information gain, Chi-Squared, and Gini Index feature selection techniques datasets after fitting Random Forest (RF), Support Vector Machine (SVM), and K-Nearest Neighbour (KNN) models. More importantly, when p-values were computed, the CFT model computation time and memory usage were statistically significantly different at 95% and 90% Confidence Interval (CI) when compared to the model on the other techniques.