Застосування алгоритмів машинного навчання для виявлення прихованих кіберзагроз на об’єктах енергетичної інфраструктури

Abstract

Listen

Translate article

The peculiarities of the tasks of cyber security of energy infrastructure objects and their differences from security tasks in information and communication systems force developers to use artificial intelligence and machine learning (ML) methods. The article provides a comparative analysis of several methods of using ML to detect anomalies in the systems of critical infrastructure facilities. To do this, the most promising ML algorithms were analyzed, comparison criteria were determined, and software development tools were considered. The public Incribo dataset was chosen for testing. Computations were made; quantitative indicators of speed and accuracy of anomaly detection by ML algorithms were obtained. The results of the research show that the use of machine learning algorithms expands the capabilities of data analysts and computer system security specialists, and can be effectively used to detect hidden cyber threats at energy infrastructure facilities. The conducted comparative analysis of a dozen machine learning algorithms using the public Incribo data set made it possible to identify the most promising of them for detecting anomalies in input data. The accuracy and speed characteristics obtained for different models made it possible to single out the algorithms most suitable for different conditions of use in information protection systems. For cases where high data processing speed is required, the K-Means and Isolation Forest methods proved to be more acceptable, and for less time-critical applications, the more accurate One-Class SVM, LSTM, and GRU algorithms are effective. In further research, it is planned to carry out experiments with finer settings of the studied algorithms in order to further improve the achieved indicators. To increase the accuracy of detecting anomalies, it is possible to use ensemble methods that combine several models of different nature. Several other public datasets are also expected to be used.