Hybrid Deep Neural Network Anomaly Detection System for SCADA Networks
Résumé
Industrial control system (ICS) or SCADA networks architecture has been evolved from isolated environments to interconnected networks with the enterprise networks and the Internet. Moreover, modern SCADA networks also encompass standard hardware and software as well as open protocols such as Ethernet and TCP/IP. SCADA networks are nowadays exposed to the same threats as the classic IT networks. Along with counter measures like antivirus, firewall, encryption, control access and other security policies, anomaly detection systems are of great importance as there is always a risk of security breach. Deep learning is drawing more and more attention these years from the research community due to outstanding results in image classification, video and natural language processing. In this paper, we propose a deep neural network (DNN) approach to build an efficient SCADA anomaly detection system. The proposed approach is a stacked sparse denoising auto-encoder (SSpDAE) to which we appended a softmax classifier to discriminate the SCADA data. The DNN anomaly detection system allows an automatic feature learning and gives better results in terms of detection rate, compared to standard approaches like random forest, Naïve Bayes, and decision tree.