ALOC: Attack-Aware by Utilizing the Adversarially Learned One-Class Classifier for SCADA System

As the volume of network attacks on supervisory control and data acquisition (SCADA) systems increases, the existing supervised methods that over-rely on priori knowledge can hardly cope with increasingly stealthy and legitimate unknown protocol attacks for heterogeneous industrial scenarios. In this article, we present an anomaly based deep learning attack-aware method called ALOC, which constitutes the dual frequency domain transform (FDT) and implicit generative adversarial networks (GANs). The former is proposed that reduces the cost of hand-designed features and normalizes raw traffic bytes as the input under different protocol types. With the assistance of a deep auto-encoder (DAE) with 1-D convolutional neural networks (1D-CNNs), the latter can automatically build a behavioral baseline based on the multiscale distribution of transformed raw bytes. The potential SCADA anomalies or intrusions can be effectively detected, which enables field operators to avoid security risks in a timely manner. Essentially, the trained model conveniently determines the anomaly boundaries by augmenting the representation capabilities of raw session information in high-dimensional space. In response, adversarial training with different loss functions is introduced to constrain the reconstruction of anomalous samples extremely, which in turn improves the detection performance and analyzes anomaly attributes. The experimental results show that the proposed approach is more effective and generalized than existing state-of-the-art baselines.