Explainable Autonomic Cybersecurity For Industrial Control Systems

Industrial Control System (ICS) networks are the most targeted systems by attackers in the world, because they are the life-blood of any country's Critical Infrastructure. In this work-in-progress paper, we propose a novel machine learning-based (decision trees) intrusion detection system for ICS networks inspired by the principals of autonomic cybersecurity with the addition of explainability. Since autonomic systems are autonomous and can be preventative (i.e., active) by nature, the added benefit of explainability helps to better establish human trust in an era where human confidence in artificial intelligence (AI) is low. In the spirit of full transparency, we clearly explain our methodology, data collection, feature development, model training and testing, and results. Our resulting models achieved an accuracy of over 95%, and we also illustrate how information can be extracted from the nodes in the decision trees to clearly explain how our models arrived at their decisions.