Intrusion Detection in an Industrial Control System Using Unsupervised Machine Learning Algorithms

In an era characterized by ubiquitous network connectivity, safeguarding the security and integrity of network traffic has become increasingly vital. The MODBUS protocol has become widely used for Industrial Control Systems (ICS) communication. However, it was not originally designed for today’s highly connected, internet-exposed environments, thereby leaving it particularly vulnerable to modern cyber-attacks. Therefore, the development of innovative, robust, and efficient intrusion detection systems (IDS) to safeguard data against cyber-attacks has become imperative. This study introduces two unsupervised machine learning algorithms namely, One-Class Support Vector Machines (One-Class SVM) with Principal Component Analysis (PCA) and Isolation Forest (iForest) for intrusion detection. PCA reduces the data’s dimensionality while preserving 97.10% of its variance, thus enabling efficient computation with minimal loss of information. To optimize the One-Class SVM, a grid search approach was employed to fine-tune hyper-parameters, specifically the kernel coefficient (gamma) and the regularization parameter (nu). A total of 25 parameter combinations were evaluated, resulting in optimal values of gamma = 10.0 and nu = 0.07525, yielding a balanced F1-score of 0.975 on the training dataset. The best-performing model achieved a high recall of 0.976, indicating strong anomaly detection capability, but had a low precision of 0.406, suggesting a high false positive rate. The iForest algorithm on the other hand demonstrated strong anomaly sensitivity, as evident by a recall of 0.985. However, it demonstrated extremely poor precision and overall accuracy thus limiting its practical deployment feasibility.