A transformer-enhanced LSTM framework for robust malicious traffic detection in industrial control systems

Abstract

Industrial control systems (ICS) play a vital role in ensuring the safe and efficient operation of critical infrastructures, including power grids, pipelines, and water treatment facilities. The detection of malicious traffic in ICS environments is inherently difficult due to the complexity and diversity of traffic characteristics. In this paper we propose a novel approach of malicious traffic classification in ICS by harnessing the strengths of both the Long Short-Term Memory (LSTM) model and Transformer architecture. Considering the temporal nature of ICS traffic data, we integrate Transformer's embedding and encoder layers into our model to effectively extract sequential features. Additionally, we focus on meticulous feature engineering of the ICS flow dataset, which is essential for accurately capturing feature relevance during model training. Besides, we employ a composite correlation calculation method as imputation matrix, ensuring that the model training is robust and the feature relationships are accurately represented. Extensive experiments are carried on the SCADA flow dataset, which includes a variety of scenarios from natural gas pipelines and water tanks, predominantly based on the Modbus protocol. Our model's performance is benchmarked against seven other models. The results show that our hybrid model outperforms the other methods, making it a promising solution for identifying malicious flows in industrial control systems.