10th International Conference on Heterogeneous Networking for Quality, Reliability, Security and Robustness

Research Article

OCSVM model combined with K-means recursive clustering for intrusion detection in SCADA systems

Download444 downloads
  • @INPROCEEDINGS{10.4108/icst.qshine.2014.256549,
        author={Leandros Maglaras and Jianmin Jiang},
        title={OCSVM model combined with K-means recursive clustering for intrusion detection in SCADA systems},
        proceedings={10th International Conference on Heterogeneous Networking for Quality, Reliability, Security and Robustness},
        publisher={IEEE},
        proceedings_a={QSHINE},
        year={2014},
        month={9},
        keywords={scada systems cyber security ocsvm},
        doi={10.4108/icst.qshine.2014.256549}
    }
    
  • Leandros Maglaras
    Jianmin Jiang
    Year: 2014
    OCSVM model combined with K-means recursive clustering for intrusion detection in SCADA systems
    QSHINE
    IEEE
    DOI: 10.4108/icst.qshine.2014.256549
Leandros Maglaras1,*, Jianmin Jiang1
  • 1: University of Surrey
*Contact email: leandrosmag@gmail.com

Abstract

Intrusion detection in Supervisory Control and Data Acquisition (SCADA) systems is of major importance nowadays. Most of the systems are designed without cyber security in mind, since interconnection with other systems through unsafe channels, is becoming the rule during last years. The de-isolation of SCADA systems make them vulnerable to attacks, disrupting its correct functioning and tampering with its normal operation.

In this paper we present a intrusion detection module capable of detecting malicious network traffic in a SCADA (Supervisory Control and Data Acquisition) system, based on the combination of One-Class Support Vector Machine (OCSVM) with RBF kernel and recursive k-means clustering. The combination of OCSVM with recursive k-means clustering leads the proposed intrusion detection module to distinguish real alarms from possible attacks regardless of the values of parameters  and , making it ideal for real-time intrusion detection mechanisms for SCADA systems. The OCSVM module developed is trained by network traces off line and detect anomalies in the system real time. The module is part of an IDS (Intrusion Detection System) system developed under CockpitCI project.