Enhanced CNN-LSTM deep learning for SCADA IDS featuring hurst parameter self-similarity

• Main Authors: Balla, Asaad, Habaebi, Mohamed Hadi, Elsheikh, Elfatih Abdelrahman Ahmed, Islam, Md Rafiqul, Mohamed Suliman, Fakher Eldin, Mubarak, Sinil
• 格式: Article
• 语言: English; English; English
• 出版: IEEE 2024
• 主题: TK7885 Computer engineering
• 在线阅读: http://irep.iium.edu.my/120262/1/120262_Enhanced%20CNN-LSTM.pdf; http://irep.iium.edu.my/120262/2/120262_Enhanced%20CNN-LSTM_SCOPUS.pdf; http://irep.iium.edu.my/120262/9/120262_Enhanced%20CNN-LSTM_WOS.pdf; http://irep.iium.edu.my/120262/; https://ieeexplore.ieee.org/document/10382525

Supervisory Control and Data Acquisition (SCADA) systems are crucial for modern industrial processes and securing them against increasing cyber threats is a significant challenge. This study presents an advanced method for bolstering SCADA security by employing a modified hybrid deep learning model. A key innovation in this work is integrating the Self-similarity Hurst parameter into the dataset alongside a CNN-LSTM model, significantly boosting the Intrusion Detection System’s (IDS) capabilities. The Hurst parameter, which quantifies the self-similarity in a dataset, is instrumental in detecting anomalies. Our in-depth analysis of the CICIDS2017 dataset sheds light on contemporary attack patterns and network traffic behaviors. The CNN-LSTM architecture was substantially altered by adding multiple convolutional layers with progressively increasing filters, batch normalization for stable training, and dropout layers for regularization. Principal Component Analysis (PCA) was applied for dimensionality reduction, thereby optimizing the dataset. Test results demonstrate the superior performance of the model incorporating the Hurst parameter, achieving 95.21% accuracy and 82.59% recall, significantly surpassing the standard model. The inclusion of the Hurst parameter marks a substantial advancement in identifying emerging threats, while architectural improvements to the CNN-LSTM model led to more robust and accurate intrusion detection in industrial control settings.