On the Effects of Data Sampling for Deep Learning on Highly Imbalanced Data from SCADA Power Grid Substation Networks for Intrusion Detection

The security of cyber-physical systems is constantly threatened through cyber-attacks using available networking infrastructure. To prevent such attacks, anomaly-based intrusion detection systems are used in practice. Unfortunately, it is considered a hard task to detect the constantly improving attacks without prior knowledge of the attacks themselves. Hence, improved intrusion detection systems are of uttermost importance for preventing successful attacks of our today's network-based infrastructure. In this paper, we focus on improving intrusion detection systems. We build on former work on intrusion detection of power grid substation SCADA network traffic where a real-world data set is available. In contrast to previous work, we take imbalances of data used to learn attack patterns into account. Besides outlining the underlying foundations, the models used, and the experimental setup, we present and discuss the experimental results obtained using the available data set.