Optimization of the Random Forest Hyperparameters for Power Industrial Control Systems Intrusion Detection Using an Improved Grid Search Algorithm
Source abstract
Abstract
The intrusion detection method of power industrial control systems is a crucial aspect of assuring power security. However, traditional intrusion detection methods have two drawbacks: first, they are mainly used for defending information systems and lack the ability to detect attacks against power industrial control systems; and second, although machine learning-based intrusion detection methods perform well with the default hyperparameters, optimizing the hyperparameters can significantly improve its performance. In response to these limitations, a random forest (RF)-based intrusion detection model for power industrial control systems is proposed. Simultaneously, this paper proposes an improved grid search algorithm (IGSA) for optimizing the hyperparameters of the RF intrusion detection model to improve its efficiency and effectiveness. The proposed IGSA boosts the speed of calculation from O(nm) to O(n × m). The suggested model is evaluated based on the public power industrial control system dataset after hyperparameter optimization. The experiment results show that our method achieves a superior detection performance with the accuracy of 98% and has more outstanding performance than the same type of work.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Smart Grid Security and Resilience · Anomaly Detection Techniques and Applications
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Electrical and Electronic Engineering, North China Electric Power University, Beijing 102206, China
China Electric Power Research Institute, Beijing 100192, China
Funding
Stata Grid Corporation of China
References (29)
Show source-provided references
1. Developing a Hybrid Intrusion Detection System Using Data Mining for Power Systems10.1109/TSG.2015.2409775 ↗
2. Sun, C., Liu, C., and Xie, J. (2016). Cyber-Physical System Security of a Power Grid: State-of-the-Art. Electronics, 5.10.3390/electronics5030040 ↗
3. Multivariate Abnormal Detection for Industrial Control Systems Using 1D CNN and GRU10.1109/ACCESS.2020.2993335 ↗
4. Morris, T., and Gao, W. (2014, January 17–19). Industrial Control System Traffic Data Sets for Intrusion Detection Research. Proceedings of the International Conference on Critical Infrastructure Protection (ICCIP), Heidelberg/Berlin, Germany.10.1007/978-3-662-45355-1_5 ↗
5. Multilayer Data-Driven Cyber-Attack Detection System for Industrial Control Systems Based on Network, System, and Process Data10.1109/TII.2019.2891261 ↗
6. The 2015 Ukraine Blackout: Implications for False Data Injection Attacks10.1109/TPWRS.2016.2631891 ↗
7. Construction of cyber security defense hierarchy and cyber security testing system of Smart Grid: Thinking and enlightenment for network attack events to national power grid of Ukraine and Israel
8. Liu, H., and Lang, B. (2019). Machine learning and deep learning methods forintrusion detection systems: A survey. Appl. Sci., 9.10.3390/app9204396 ↗
9. Research on intrusion detection of industrial control system
10. An Intrusion-Detection Model10.1109/TSE.1987.232894 ↗
11. Deep Learning Approach for Intelligent Intrusion Detection System10.1109/ACCESS.2019.2895334 ↗
12. Survey of Intrusion Detection Systems: Techniques, Datasets and Challenges10.1186/s42400-019-0038-7 ↗
13. Research on Intrusion Detection Classification Based on Random Forest
14. Gattineni, P., and Dharan, G.R.S. (2021, January 2–4). Intrusion Detection Mechanisms: SVM, random forest, and extreme learning machine (ELM). Proceedings of the 2021 Third International Conference on Inventive Research in Computing Applications (ICIRCA), Coimbatore, India.10.1109/ICIRCA51532.2021.9544551 ↗
15. Wang, Z., Jiang, D., Huo, L., and Yang, W. (2021). An efficient network intrusion detection approach based on deep learning. Wireless Netw., 1–14.10.1007/s11276-021-02698-9 ↗
16. Anton, S.D.D., Sinha, S., and Schotten, H.D. (2019, January 19–21). Anomaly-based Intrusion Detection in Industrial Data with SVM and Random Forests. Proceedings of the 2019 International Conference on Software, Telecommunications and Computer Networks (SoftCOM), Split, Croatia.10.23919/SOFTCOM.2019.8903672 ↗
17. Zhu, G., Yuan, H., Zhuang, Y., Guo, Y., Zhang, X., and Qiu, S. (2021, January 16–17). Research on network intrusion detection method of power system based on random forest algorithm. Proceedings of the 2021 13th International Conference on Measuring Technology and Mechatronics Automation (ICMTMA), Beihai, China.10.1109/ICMTMA52658.2021.00087 ↗
18. Hink, R.C.B., Beaver, J.M., Buckner, M.A., Morris, T., Adhikari, U., and Pan, S. (2014, January 19–21). Machine learning for power system disturbance and cyber-attack discrimination. Proceedings of the 2014 7th International Symposium on Resilient Control Systems (ISRCS), Denver, CO, USA.
19. A hybrid intrusion detection system based on scalable K-means+ random forest and deep learning10.1109/ACCESS.2021.3082147 ↗
20. Hyperparameters and tuning strategies for random forest10.1002/widm.1301 ↗
21. A survey of random forest based methods for intrusion detection systems10.1145/3178582 ↗
22. Hutter, F., Hoos, H., and Leyton-Brown, K. (2014, January 21–26). An efficient approach for assessing hyperparameter importance. Proceedings of the 31st International Conference on Machine Learning, Beijing, China.
23. Van Rijn, J.N., and Hutter, F. (2018, January 19–23). Hyperparameter importance across datasets. Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, London, UK.10.1145/3219819.3220058 ↗
24. Zhang, A., Lipton, Z.C., Li, M., and Smola, A.J. (2021). Dive into deep learning. arXiv.
25. A specification-based intrusion detection framework for cyber-physical environment in electric power system
26. (2022, May 20). Tommy Morris—Cyber Attack Datasets. Available online: https://sites.google.com/a/uah.edu/tommy-morris-uah/ics-data-sets.
27. Investigating the impact of data normalization on classification performance
28. A network attack identification model of smart grid based on XGBoost
29. Moubayed, A., Injadat, M., and Shami, A. (2020, January 14–17). Optimized random forest model for botnet detection based on DNS queries. Proceedings of the 2020 32nd International Conference on Microelectronics (ICM), Aqaba, Joradn.10.1109/ICM50269.2020.9331819 ↗