Traffic Modeling by Recurrent Neural Networks for Intrusion Detection in Industrial Control Systems

The paper examines various aspects of the machine learning methods applicability for intrusion detection in Industrial Control Systems (ICS) using Gas Pipeline data set as an example. Several reasons which make it difficult to use classical classification, clustering, and anomaly detection algorithms to identify anomalies of industrial processes were formulated as a result of analyzing number of papers. It's proposed to use recurrent neural networks to model and predict the network traffic of the ICS for the anomaly detection. It was shown that by predicting the network traffic of the ICS, the anomalies caused by a network attack can be identified. The results of experiments of two recurrent neural network architectures (LSTM and GRU) usage for intrusion detection on the Gas Pipeline data set are presented. The capabilities of the considered recurrent neural network architectures were demonstrated in the intrusion detection problem of ICS. An optimal architecture of recurrent neural networks was determined depending on the specified security level and used computing resources.