Self-Learning Spatial Distribution-Based Intrusion Detection for Industrial Cyber-Physical Systems

Abstract

Thanks to the great advancement of cognitive computing, artificial intelligence, big data, and the Internet of Things (IoT) technologies, the fusion of the physical and virtual worlds is changing people’s lifestyles. Although the research and deployment of cyber-physical systems (CPSs) are notably promoted by cognitive computing, the reliability and large-scale application of CPSs are still significantly challenged by some security issues. Therefore, it is meaningful to clarify and address the weaknesses of current intrusion detection methods for CPSs and enhance the ability to identify, analyze, and predict to improve the performance of intrusion detection. In this article, we first propose a novel self-learning spatial distribution algorithm, named Euclidean distance-based between-class learning (EBC learning), which improves between-class learning by calculating the Euclidean distance (ED) among <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$k$ </tex-math></inline-formula> -nearest neighbors of different classes. In addition, a cognitive computing-based intrusion detection method named border-line SMOTE and EBC learning based on random forest (BSBC-RF) is also proposed based on the EBC learning for industrial CPSs. The experimental results over a real industrial traffic dataset show that the proposed EBC learning has strong spatial constraint capability and can improve the prediction and recognition performance. Compared with the eight state-of-the-art methods, the proposed method has an ACC exceeding 99.5%, false alarm rate (FAR) less than 0.06%, and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$F1$ </tex-math></inline-formula> close to 0.99, which is still superior to other ones.