High-level intrusion detection system for highly reliable communication networks

Abstract

The high-dimensional intrusion detection system for a high-reliability communication network according to the present invention is characterized by processing a Supervisory Control and Data Acquisition (SCADA) dataset of an Industrial Control System (ICS) through an agnostic chi-square and classifying communication network traffic into benign and malicious events using a pre-organized Decision Tree (DT) algorithm.

Description

Technology Field

[0001] The present invention relates to a communication network intrusion detection system, and more specifically, to a high-dimensional intrusion detection system for a high-reliability communication network of an Industrial Internet of Things (IIoT) network. Background Technology

[0003] The growth of the Industrial Internet of Things (IIoT) using SCADA (Supervisory Control and Data Acquisition) networks has become significant due to the capabilities of connected devices and operations. Conventional technologies, including the interconnection of field devices such as actuators and sensors, reflect the increase in cyber attacks. Previously, Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) were intended to operate standalone while minimizing attack vulnerabilities. Currently, SCADA and large-scale networks increase vulnerability due to the utilization efficiency of open access networks.

[0004] In particular, robust IIoT vulnerabilities arise due to the diverse configurations of networks adopting practically distributed architectures, especially in widely distributed IIoT applications such as SCADA (Supervisory Control and Data Acquisition). Therefore, inadequate SCADA security can lead to disaster.

[0006] Figure 1 shows an intrusion into a Supervisory Control and Data Acquisition (SCADA) Industrial Internet of Things (IIoT) architecture.

[0007] The advancement of the Industrial Internet of Things (IIoT) enhances industrial operations. Nevertheless, its widespread adoption faces significant challenges. A critical concern is the security of the vast amounts of data transmitted across these networks. To address these security issues, interoperable technologies for network monitoring are required for effective mitigation to detect attacks and intrusions within the architecture of Industrial Internet of Things applications.

[0008] Communication delays are unacceptable in Supervisory Control and Data Acquisition (SCADA) industrial operations due to the inclusion of components and protocols that increase complexity. Service and data delivery can also be delayed due to complementary components such as anti-malware and firewall functions. Most Industrial Internet of Things (IIoT) systems operate continuously in real-time without delay, regardless of the volume of data. Furthermore, the communications of these systems are vulnerable to a series of attacks. Recent cyberattack incidents have been increasing and are having a severe impact on critical utility sectors, such as power plants and control systems.

[0009] There have been reports of attacks on the Industrial Internet of Things (IIoT) initiating to flood networks with a series of demands, thereby compromising bandwidth and denying access to valid users. Furthermore, the sequence of these attacks penetrates multiple layers of the Open Systems Interconnection (OSI) model[9], degrading system performance. Notably, existing Intrusion Detection Systems (IDS) are currently inadequate to address these threats. To protect Supervisory Control and Data Acquisition (SCADA) network communications, robust and powerful security technologies based on Artificial Intelligence (AI) for real-time vulnerability detection and attack detection algorithms are essential.

[0011] The advancement of Artificial Intelligence (AI) in the current industrial environment has enabled significant advancements in intrusion detection utilizing Machine Learning (ML) and Deep Learning (DL) approaches. Mechanisms such as antivirus software, Intrusion Detection Systems (IDS), and firewalls have been implemented to mitigate vulnerabilities to attacks. Nevertheless, the mobility of attacks on big data has become severe due to problems arising from reliance on agnostic, untrustworthy, and computationally complex technologies. Furthermore, the inability to use evaluation metrics such as SCADA (non-specific target domain datasets) and accuracy is also a problem. Current Intrusion Detection Systems designed for anomaly detection in large-scale heterogeneous sensor data, which possess inherent noise and high dimensionality, often degrade the generalization of Machine Learning (ML) models.

[0012] Intrusion Detection System (IDS) technologies for mitigating attacks on SCADA networks relying on feature selection (FS) have been motivated by invention recognition due to the overwhelming prevalence of misleading results and the demand for agnostic FS approaches that do not rely on models by using computationally less complex classifiers. Various Machine Learning (ML) methods have utilized existing techniques for feature selection. However, a significant limitation prevalent in existing inventions is that the high cost of feature extraction and long execution times reduce real-time detection accuracy. A second limitation is the agnostic FS technique that restricts the system to specific technologies. Third, considering the numerous advanced detection algorithms, there are relatively few that emphasize time-efficient distinguishing features between malicious and benign traffic, which are crucial for improving classification performance. Additionally, the limited amount of data required for FS and the bias in dataset balancing guaranteed by data scarcity are also issues. The premise is to maintain the performance of a specific technique using balanced datasets and model dependencies as the most suitable Machine Learning (ML) candidate, without investigating larger, imbalanced-volume datasets and other models. It should be noted that the FAR (False Alarm Rate) increases with larger amounts of data. For real-time tasks executed inappropriately with imbalanced or massive data, the f1 score and accuracy are assumed as primary evaluation parameter metrics, without relying on execution time. Prior art literature

[0014] KR10-2023-0054376 A The problem to be solved

[0015] The present invention is proposed to solve the technical problems described above and aims to construct an ideal intrusion detection model with high detection accuracy based on a model-agnostic approach to derive important data features. Since the goal is to obtain data features critical to anomaly detection, the agnostic chi-square approach relies on the ability to determine the relationship between predictor variables and responses. Furthermore, due to the large size of heterogeneous Supervisory Control and Data Acquisition (SCADA) datasets, the agnostic chi-square approach is essential for reducing FAR (False Alarm Rate) and execution time, and for maintaining enhanced detection accuracy by utilizing the most important attributes. Consequently, the combination of intelligent agnostic chi-square feature selection (FS) and a pre-organized decision tree algorithm (CH-DT) for anomaly detection and classification resolves the limitations of existing inventions. Unlike existing solutions, the proposed agnostic chi-square feature selection (FS) approach is not dependent on the model and promotes model interoperability, allowing for easy integration with selected classifiers. means of solving the problem

[0017] According to one embodiment of the present invention for solving the above problems, a high-dimensional intrusion detection system for a high-reliability communication network is provided, which processes a Supervisory Control and Data Acquisition (SCADA) dataset of an Industrial Control System (ICS) through an agnostic chi-square and classifies communication network traffic into benign and malicious events using a pre-organized Decision Tree (DT) algorithm.

[0018] In addition, according to another embodiment of the present invention, a high-dimensional intrusion detection system for a high-reliability communication network is provided, comprising: a data preprocessing unit that organizes data with 0, null, and infinity values ​​in a Supervisory Control and Data Acquisition (SCADA) dataset of an Industrial Control System (ICS); an agnostic chi-square processing unit that classifies data preprocessed by the data preprocessing unit through an agnostic chi-square with a predetermined p-value threshold; an algorithm processing unit that processes data classified by the agnostic chi-square processing unit using a pre-organized decision tree algorithm; and a detection and classification unit that analyzes communication network traffic processed by the algorithm processing unit and classifies it into benign and malicious events.

[0019] In addition, the agnostic chi-square processing unit in the present invention is characterized by using an agnostic chi-square with a p-value threshold of 0.05.

[0020] In addition, the algorithm processing unit in the present invention is characterized by processing pre-pruning with a maximum depth (max-depth) of 20 in the decision tree algorithm. Effects of the invention

[0022] The uniqueness of the present invention is the flexibility to integrate a pre-organized decision tree algorithm (CH-DT) and other state-of-the-art classifiers achieved in three stages: 1) data preparation for standardization; 2) the fusion of an agnostic chi-square feature selection (FS) approach for feature engineering of large-scale unstructured data for efficient Intrusion Detection Systems (IDS); and 3) the evaluation of the proposed agnostic pre-organized decision tree algorithm (CH-DT) together with other feature selection (FS) candidates and classifiers for attack detection and classification. Based on this, the proposed agnostic pre-organized decision tree algorithm (CH-DT) technology must be adaptable to detect complex / zero-day attacks in vast and sparse amounts of Supervisory Control and Data Acquisition (SCADA) network data, while extracting valuable features while minimizing the False Alarm Rate (FAR), computational complexity, and execution time costs. It takes into account the real-time requirements for critical industrial systems such as Supervisory Control and Data Acquisition (SCADA). Since attack detection and classification with low FAR (false alarm rate), computational complexity, execution time cost, and latency performance are essential, the present invention proposes this.

[0023] It is an agnostic statistical chi-square for feature extension and dimensionality reduction that guarantees data fit with ML / DL algorithms and ensures the efficiency of model performance. By deriving the most relevant features, the dimensionality of the dataset for model training is reduced, and the efficiency of classification techniques is evaluated.

[0024] The proposed agnostic chi-square feature selection (FS) technique for an enhanced and efficient Intrusion Detection System (IDS) is combined with a classification algorithm and a pre-organized decision tree. It is intended for an efficient and flexible Intrusion Detection System (IDS) module. The flexibility of the proposed agnostic pre-organized decision tree algorithm (CH-DT) technique lies in its adaptability and fit to the selected classification algorithm, thereby eliminating the problem of feature selection (FS) model dependency found in existing inventions. The reliability of the proposed agnostic pre-organized decision tree algorithm (CH-DT) architecture was verified using various ML and DL algorithms on four recently published datasets. Brief explanation of the drawing

[0026] Figure 1 is a diagram showing an Industrial Internet of Things (IIoT) network demonstrating an intrusion. Figure 2 is a diagram showing the structure of the proposed pre-organized Decision Tree (DT) algorithm. Figure 3 shows the proposed overall system design architecture of an agnostic pre-organized decision tree algorithm (CH-DT) for a Supervisory Control and Data Acquisition (SCADA) Intrusion Detection System (IDS) representing each process activity. Figure 4 is a diagram showing the ICS-SCADA data set before data cleanup. Figure 5 is a diagram showing the ICS-SCADA data set after data cleaning. Figure 6 is a diagram showing a heatmap of the correlation matrix displaying selected features with low correlation. Figure 7 is a graph showing features selected using the agnostic chi-square according to feature importance rankings. Specific details for implementing the invention

[0027] Hereinafter, in order to explain in detail enough for a person skilled in the art to easily implement the technical concept of the present invention, embodiments of the present invention will be described with reference to the attached drawings.

[0029] The widespread adoption of the Industrial Internet of Things (IIoT) driven by the application of SCADA (Supervisory Control and Data Acquisition) has led to an increase in heterogeneous sensor data, thereby raising the risk of intrusion and attacks. The presence and influence of intruders, as well as their innovative attack techniques, are also on the rise. Existing Intrusion Detection Systems (IDS) tend to be costly to process this type of data due to noise. Since available methods in real-time domains are delayed, there is a need for further inventions regarding effective feature extraction methods, which are fundamental to Machine Learning (ML) for time-critical situations.

[0031] The present invention proposes a combination of an efficient Machine Learning (ML) classifier and an agnostic feature selection (FS) method for attack detection and classification in real-time SCADA (Supervisory Control and Data Acquisition) networks by comparing and analyzing some feature selection (FS) techniques.

[0032] The flexibility and interoperability of the proposed approach address the computational complexity of vulnerability detection systems while reducing FAR (false alarm rate) and overall model execution time. In terms of online preprocessing, the proposed technique proceeds in stages.

[0033] 1) Data preparation consisting of data cleaning and normalization

[0034] 2) A combination of a pre-pruned (pruned) Decision Tree (DT) algorithm and an agnostic chi-square FS (feature selection) approach was constructed. An optimal subset of data features for an efficient Intrusion Detection System (IDS) is obtained.

[0035] 3) Evaluate the proposed agnostic DT-CH (Decision Tree with Chi-squared-based Feature Selection) and other FS (feature selection) candidates for anomaly detection.

[0037] 2. Proposed System Methodology

[0038] A. Description of the Proposed Framework

[0039] The present invention relates to a high-dimensional intrusion detection system for a high-trust communication network that can classify network traffic into benign and malicious events by analyzing communication network traffic through a novel method combining an agnostic chi-square feature selection (FS) method and a pre-pruned decision tree (DT) algorithm.

[0041] This paper introduces a proposed technique for a combined Intrusion Detection System (IDS) that utilizes pre-organized Decision Trees (DTs) and an agnostic chi-square feature selection (FS) method to analyze Supervisory Control and Data Acquisition (SCADA) communication network traffic and classify it into benign and malicious events. The non-model-dependent approach combines the agnostic chi-square, a filter-based feature selection methodology, with pre-organized Decision Trees (DTs). Using this approach enables adaptability by establishing interoperability, as it allows for interchangeability with algorithms selected by classification models. This new approach consists of three stages.

[0042] Step 1 is data preprocessing, which includes cleaning up data of 0, null, and infinity values ​​for practical use in real-world scenarios for data integrity in a real-time Intrusion Detection System (IDS). The next step is feature dimensionality reduction and scaling of out-of-range features present in the dataset.

[0043] Step 2 is an agnostic chi-square-based feature selection (FS) scheme that determines the most important data features of the dataset based on correlation analysis. As a result, a pre-organized decision tree (DT) is constructed as shown in Figure 2.

[0044] Finally, the third step is attack detection and classification. Precision and computing speed are the two essential real-time traffic monitoring elements achieved by this integrated approach.

[0045] In the proposed agnostic chi-square feature selection (FS) technique, raw data is preprocessed for standardization using a Z-score strategy as follows. The optimal subset is determined by utilizing agnostic chi-square analysis. The candidate with the highest statistical score possesses the most optimal attributes. The optimal pruned Decision Tree (DT) layer uses the result selections for detection and classification. Figure 3 illustrates the entire process of the proposed agnostic CH-DT framework. Specifically, Figure 3 shows the proposed overall system design architecture of the agnostic CH-DT for SCADA IDS representing each process activity, and data preprocessing can be online or offline.

[0047] B. Pre-pruned Decision Tree (DT)

[0048] The tree-like structure representing a decision set indicates a Decision Tree (DT) that establishes classification rules for a dataset. Consequently, every Decision Tree (DT) can have a set of decision criteria (DCs). As a result, the set of DCs (Direct Current) is an alternative version of the Decision Tree (DT). Although identical, the knowledge gained from the data is emphasized more implicitly through decision rules than through the Decision Tree (DT). Every node in a Decision Tree (DT) represents a test performed to classify the features of an instance, and every derivative represents a potential feature value. Instances are classified based on the root node and follow a specific path in the DT according to their corresponding feature values. Tree leaves represent the partitioning of the dataset based on the classification performance, and the subtrees of the Decision Tree (DT) reflect the response to the classification problem solved above the root node of that subtree. At the node level, dataset partitioning is performed based on the partitioning criteria (feature extraction measures). The "Gini" metric refers to impurities that measure the label similarity of nodes used to split Decision Tree (DT) nodes. Pruning is generally performed after the Decision Tree (DT) has grown. The entire tree is cut to prevent overfitting and improve the classification accuracy of the Decision Tree (DT). Pre-pruning and post-pruning are two interesting strategies for Decision Tree (DT) trimming. Pre-pruning is performed while the tree is growing, while post-pruning is performed after the tree has fully grown. For model efficiency, this invention implements pre-pruning with a max-depth of 20, which represents optimal node expansion. This indicates the depth level of the tree.A maximum depth of 20 is intended to build a classification model with higher accuracy and minimal error while consuming minimal execution time. However, more splitting implies deeper trees, which tend to capture more data features and affect the model's detection accuracy. Furthermore, increased execution time costs and computational complexity often negatively impact model performance, without significantly improving detection accuracy. In the proposed CH-DT, the entropy for information gain was intended to ensure optimal performance across all datasets. Model performance was enhanced by hyperparameter tuning of Decision Tree (DT) parameters using GridSearchCV (Grid Search Cross-Validation), resulting in the generation of an optimal Decision Tree (DT) algorithm combined with the agnostic chi-square for the proposed agnostic CH-DT technique. The CH-DT pseudocode is specified in Algorithm 1.

[0049] <Algorithm 1>

[0050]

[0052] C. Data Preprocessing and Simulation Environment

[0053] The proposed system was trained and tested on Google Colab using several Keras and Scikit-learn modules. Data samples were split 70% for training and 30% for testing, with 20% of the set used to validate the system during training. This procedure can be performed on a minicomputer. A high-level execution computer equipped with a GPU may not be required. All tests were performed using an NVIDIA GeForce GTX 1050, 8GB VRAM, and a Windows 10 64-bit operating system.

[0054] Preprocessing is essential to derive high-quality data before feeding the dataset to the proposed model. In the preprocessing step, nulls, zeros, and infinities must be inspected and removed to obtain clean data. Considering the application of the proposed agnostic chi-square in critical real-time IIoT environments with time constraints, the proposed agnostic chi-square could be online. However, in this invention, it was offline. This is a future direction in a limited sense. Then, feature alignment and combination are performed to evaluate only relevant features, thereby improving the learning reliability of the proposed model.

[0056] Supervisory Control and Data Acquisition (SCADA) network traffic data is critical because it originates from the complex architecture of network monitoring mechanisms, substation equipment control systems, and communication protocols. It is used to extract unique functions from network communication traffic. Generally, data streams obtained from actuators and sensors in real-time systems exhibit reliability issues, such as erroneous information resulting from signal loss or insufficient computation. Therefore, the data cleaning phase compensates for these limitations that affect model inference.

[0057] The ICS-SCADA dataset containing 128 data functions is subject to cleanup as it includes null, zero, and infinity. To achieve this, null, infinity, and empty values ​​were removed from the dataset.

[0059] Figure 4 is a heatmap showing the distribution of inconsistent features of the data set. Specifically, Figure 4 is a diagram showing the ICS-SCADA data set before data cleanup, which visually represents all 128 features present in the data set before data cleanup, displaying columns containing Null, 0, and infinity.

[0060] It is evident that the dataset contains not only too many features but also a significant number of zeros, nulls, infinities, and redundant features. These features affect the integrity of traffic datasets generated by real-time systems and the model performance of the IDS. Through data cleaning, a total of 76 data features were implemented.

[0062] Figure 5 shows the aftereffects of data cleaning that demonstrate consistent data characteristics. Specifically, Figure 5 is a diagram showing the ICS-SCADA data set after data cleaning, which represents the result of a data cleaning process reduced to 76 functions.

[0063] Subsequently, a collinearity test was conducted to verify the correlations between predictor variables. This prevents high predictor correlations with the dependent variable that affect model performance. The proposed model filters out highly correlated positive and negative features using a correlation threshold of 0.7 or higher (see Fig. 6 for the heatmap of the correlation matrix of the derived features; i.e., Fig. 6 is a heatmap of the correlation matrix showing selected features with low correlation).

[0065] When using the Scikit-learn min-max scaling function, feature scaling is generally required. Here, the feature scale is reduced to between 0 and 1. Additionally, various scales of the dataset, which can sometimes be extensive, are considered. A specific feature may have a scale distributed between 10 and 100 or between 10 and 10,000. Values ​​between 0 and 1 must be considered. The equation for the min-max scaler is as follows:

[0066] <Equation 1>

[0067]

[0068] Here, y is 1 and x is 0.

[0070] D. Feature Selection

[0071] A complete understanding of network traffic characteristics is required for feature extraction, as it aids in selecting relevant features. Feature selection (FS) facilitates the selection and enhancement of the performance of the proposed model, particularly for classification. It addresses data dimensionality issues arising from numerous attributes outside the sample. In most cases, this leads to the model overfitting, preventing it from generalizing to new data samples. Furthermore, it is desirable to ensure an easy and explainable model with controllable features, which is only possible by avoiding too many undesirable and redundant features. Finally, it is advisable not to overload the proposed model with data characteristics, as this affects the model's training and testing times. To achieve this goal, the present invention implements an agnostic chi-square with a p-value threshold of 0.05. The threshold helps determine data independence.

[0072] Assume a dataset of two variables including observed counts (OC) and predicted counts (EC). The chi-square calculates how the observed counts (OC) and predicted counts (EC) differ. The chi-square is as follows:

[0073] <Equation 2>

[0074]

[0076] d represents degrees of freedom, EC represents the expected value, and OC represents the observed value. Through this approach, 14 of the most relevant features can be implemented according to the ranks shown in Fig. 7. Fig. 7 is a graph showing features selected using the agnostic chi-square according to feature importance ranks. Features labeled "H", "C", "E", "A", and "AN" occupy the highest ranks as shown in Fig. 7 and are therefore intended for model training. Here, "H" represents the phase AC voltage phase angle, "C" represents the phase AC voltage magnitude, "E" represents the phase AC voltage current phase angle, "A" represents the phase AC current magnitude, and "AN" represents the positive-negative-zero voltage phase angle. To test the proficiency of the proposed technique, four state-of-the-art ML classifiers and four Deep Learning (DL) frameworks were used. The Machine Learning (ML) classifiers compared include AdaBoost (AD), XGBoost (XGBoost), RF, and GradientBoost (GB). In addition, the DL models compared were Convolutional Neural Networks (CNN), Hybrid CNN, Long Short Memory (CNN+LSTM), Long Short Memory (LSTM), and Bi-LSTM. Finally, the derived optimal features were utilized for attack classification by the proposed pre-pruned DT model. The novelty of the proposed agnostic approach is that it evaluates the fit and adaptability of all selected algorithms by considering the types and features of relevant datasets, which are model selection and design elements for cyber security attacks. All examined datasets and models used the same parameter settings for fair comparison.

[0077] Table II shows the selected model parameters for the ML classifier, and Table III shows the model parameters for the evaluated comparative DL algorithms. Although the two datasets were imbalanced in the actual scenario, the important point is that the proposed method did not implement upsampling or downsampling techniques, and this is not the case in the actual scenario where the suitability of the proposed method is further verified for both large and sparse datasets in a real-time environment.

[0078] Table II

[0079]

[0081] Table III

[0082]

[0084] As described above, the high-dimensional intrusion detection system (1) for a high-reliability communication network of the present invention comprises a data preprocessing unit (10), an agnostic chi-square processing unit (20), a tree algorithm processing unit (30), and a detection and classification unit (40).

[0085] In other words, a high-level intrusion detection system for high-reliability communication networks processes Supervisory Control and Data Acquisition (SCADA) datasets of Industrial Control Systems (ICS) through agnostic chi-square and classifies communication network traffic into benign and malicious events using a pre-organized Decision Tree (DT) algorithm.

[0087] The data preprocessing unit (10) cleans up data with 0, null, and infinite values ​​in the Supervisory Control and Data Acquisition (SCADA) data set of the Industrial Control System (ICS).

[0088] The agnostic chi-square processing unit (20) classifies the data preprocessed in the data preprocessing unit through an agnostic chi-square with a predetermined p-value threshold. In this embodiment, the agnostic chi-square processing unit uses an agnostic chi-square with a p-value threshold of 0.05.

[0089] The tree algorithm processing unit (30) processes the data classified by the agnostic chi-square processing unit using a pre-organized decision tree algorithm. In this embodiment, the algorithm processing unit performs pre-pruning with a maximum depth (max-depth) of 20 in the decision tree algorithm.

[0090] The detection and classification unit (40) analyzes the communication network traffic processed by the algorithm processing unit and classifies it into positive events and malicious events.

[0092] 3. Experimental Results and Discussion

[0093] A. Evaluation Indicators

[0094] To ensure a fair comparison, traditional performance criteria—precision Pr, accuracy Ac, execution cost Ec, f1-score F1, and recall Re—were used. In summary, an effective detection system must have the accuracy, precision, recall, and f1-score with the lowest execution cost within the real-time system timeout threshold. Accuracy is as follows:

[0096] <Equation 3>

[0097]

[0098] And precision, recall, and f1-scores are as follows.

[0100] <Equation 4, Equation 5, Equation 6>

[0101]

[0103] Here, Tp, Tn, Fp, and Fn represent true positive, true negative, false positive, and false negative results. The Mathews correlation coefficient (MCC) evaluation parameter measures inter-class reliability to investigate the reliability of the proposed model's performance. It is an essential statistic for imbalanced datasets. In particular, it evaluates the model's performance regarding data imbalance due to the disadvantage of using the F1-score, which generates exaggerated results for imbalanced datasets. Additionally, by examining the False Alarm Rate (FAR) as an important parameter metric, the feasibility of the proposed agnostic approach in reducing the FAR is verified. Chicco and Jurman completed extensive research and presented the Mathews correlation coefficient (MCC) as a viable approach. As shown in Equation (7), the Mathews correlation coefficient (MCC) is a mathematical expression. Mathews correlation coefficient (MCC) values ​​ranging from -1 to +1 indicate perfect misclassification and classification.

[0105] <Equation 7>

[0106]

[0108] B. Data Set Description

[0109] Table IV

[0110]

[0111] The proposed model evaluates two ICS (ICS-SCADA) datasets to verify the capabilities of the proposed technology.

[0112] 1) ICS-SCADA Data Set: Oak Ridge National Laboratories (ORNL) created this information by constructing a power grid testbed. The data set generated from the power grid testbed consists of calculations related to disturbances, cyberattack exploits, non-attacks, and control obtained during electrical transmission. This data set includes 128 functions and 3 responses (attack and non-attack). R# (refer to Signal) indicates these characteristics and represents the Phasor Measurement Unit (PMU) ratio and analysis type. For example, the voltage phase angle determined by PMU R1 is R1-PA1:VH. A total of 16 new columns are for cork alarms, control panel logs, and relay logs, as well as for a mix of relays and PMUs. The marker in the last column distinguishes labeled events (for a description of data set functions, refer to Data Set Functions in Table IV).

[0113] 2) WUSTL-IIOT-2018 Dataset: The WUSTL-IIoT-2018 ICS dataset for SCADA cybersecurity inventions targets reconnaissance attacks on Supervisory Control and Data Acquisition (SCADA). Reconnaissance involves using an intruder's precision inspection equipment to discover network devices and potential vulnerability sites. Subsequent reconnaissance attacks performed device identification and exploitation attacks, port scanners, and address scans on the testbed. While the base data includes 25 networking features, the authors used feature selection (FS) to choose the most promising features for achieving the dataset: Source / Destination Packet Count (SrcPkts), Destination / Source Packet Count (DstPkts), Source / Destination Transaction Bytes (SrcBytes), and Port Count (SrcBytes). Additionally, it was a system device for creating and implementing audit logs to monitor all network traffic, consisting of 93.93% beneficiary traffic and 6.07% malicious traffic.

[0115] C. Performance Evaluation of the Proposed Model

[0116]

[0117]

[0119] Table V compares the integration of the proposed agnostic chi-square feature selection (FS) approach, the Pearson Correlation Coefficient (PCC), and Recursive Feature Elimination (RFE). The proposed approach demonstrated significant performance across all four dataset scenarios. Although RFE achieved 100% detection accuracy in one scenario, it is a model susceptible to overfitting because the WUSTL-IIoT-2018 dataset contains very few data features, in contrast to other scenarios with much broader features. During model training, the initial pass of RFE utilizes all candidate features to train the model, leading to overfitting in a dataset with few data features. It is insightful to note that the proposed CH-DT maintained consistent significance across the four evaluated dataset scenarios. This demonstrates the validity of the proposed agnostic chi-square in IIoT using extensive heterogeneous sensor data and various attack types.

[0121] Table VI

[0122]

[0123] Table VII

[0124]

[0125] Table VIII

[0126]

[0127] Table VI shows the performance of the proposed agnostic CH-DT and other comparison models in terms of detection accuracy Ac and runtime Tt on the ICS-SCADA dataset.

[0128] Table VII shows a comparison of ML and DL candidates for the proposed agnostic CH-DT IDS technique on the WUSTL-IIOT-2018 dataset, highlighting model detection accuracy and training time.

[0129] Table VIII is Feature selection (FS) It shows a performance comparison analysis of the selected models without.

[0130] The proposed CH-DT demonstrated training and test detection accuracy of 99.09% and 99.35% at minimum training and test times of 0.122 and 0.0000010 seconds, respectively. Similarly, Table 7 highlights the performance of the proposed agnostic CH-DT and other comparative models on the WUSTL-IIoT-2018 dataset in terms of training and test detection accuracy Ac and training time Tt, recording a training and test detection accuracy of 99.98% at training and test detection times of 1.55 and 0.0000015 seconds, respectively. Consequently, Table VIII presents the performance of various ML and DL candidates without feature selection (FS). Further demonstrating the novelty of the agnostic CH-DT are the experimental results of the Unpruned DT, which achieved a detection accuracy of 89% at 12.03 seconds and recorded a posterior truncation accuracy of 96.4% at 5.06 seconds. The flexibility of the proposed agnostic CH-DT is verified. Furthermore, the objectives of the present invention and the impact of feature selection (FS) are highlighted in identifying critical features required for the deployment of an Intrusion Detection System (IDS) to achieve optimal accuracy with minimal cost-effectiveness. Table IX, which evaluates four publicly available datasets, provides a performance summary of the proposed CH-DT model, showing training detection accuracy, time, precision, recall, and f1-score. Additionally, Table X presents test detection accuracy, time, precision, recall, and f1-score. Experimental results demonstrate the efficiency and importance of the proposed agnostic CH-DT approach in detecting attacks in SCADA networks. Moreover, comparing the proposed agnostic CH-DT approach with the results of the prior art, Table XI shows simulation results with the proposed agnostic CH-DT, notable for the combined benefits of execution time (s) and detection accuracy (%) across all evaluated datasets.Therefore, we verify the reliability and efficiency of the proposed agnostic CH-DT framework for attack detection in industrial environments, particularly in SCADA networks.

[0132] Table IX

[0133]

[0134]

[0135]

[0137] Table XI

[0138]

[0140] Table IX shows the training performance of the proposed agnostic CH-DT model across the evaluated latest datasets, Table X shows the testing performance of the proposed agnostic CH-DT model across the evaluated latest datasets, and Table XI shows a comparison of existing studies.

[0141] In addition, to verify the reliability of the approach, the proposed agnostic CH-DT model was also evaluated on the NSL-KDD, WUSTL-IIoT-2018, and CICIDS2018

[45] datasets. The proposed CH-DT model is shown in Tables IX and X. Furthermore, the feasibility and performance of the proposed agnostic chi-square feature selection (FS) are described across all models compared with five ML classifiers and four DL models using the same methodology, platform, and experimental environment. The evaluation results show the training and test measurements for model execution time, respectively. However, due to time constraints, the present invention could not re-evaluate the existing invention. Therefore, the results of the existing invention are compared as is (see Table XI). Examining various publicly available datasets verifies the feasibility of the performance of the proposed agnostic CH-DT model in detecting various attack types. Considering the impact of data class imbalance on model performance, the proposed agnostic CH-DT model was evaluated on four publicly available datasets without any form of data balancing technique. The simulation results in Table XII indicate that data balancing is not important in the proposed agnostic CH-DT model, based on the ability to detect attacks significantly in scenarios with almost no malicious traffic.

[0143] Table XII

[0144]

[0145] Table XIII

[0146]

[0147] Table XII shows the performance of the proposed agnostic CH-DT technology across the evaluated datasets without data balancing. As can be seen from the experimental results in Table XII, the Matthews correlation coefficient (MCC) enabled the determination of model performance in reducing the False Alarm Rate (FAR) in highly heterogeneous SCADA datasets. The ability of the proposed agnostic CH-DT model to accurately detect attacks with minimal error makes it ideal for Intrusion Detection Systems (IDS) in real-time scenarios. Table XIII shows the model performance verification using MCC on the evaluated datasets.

[0149] 4. Conclusion

[0150] This invention presents an agnostic chi-square feature selection (FS) and a pre-prune decision tree (DT) for intrusion detection in Supervisory Control and Data Acquisition (SCADA) networks. The framework of the proposed technique is a combination of the agnostic chi-square feature selection (FS) approach and the pre-prune decision tree (DT) algorithm (CH-DT). The novelty of the agnostic chi-square approach lies in the non-model dependency of attack classification algorithms and interoperability with random selection. This aimed to derive the most efficient Intrusion Detection System (IDS) technique, particularly in large-scale heterogeneous sensor environments that generally struggle with high FAR (false alarm bowls). The architecture began with data preprocessing, where irrelevant features were removed and a consistent dataset was formed. Subsequently, highly correlated data and the feature selection (FS) process were reduced. The agnostic chi-square method aimed to obtain an optimal subset of data features by ranking them critical for attack detection. This process identified the 12 most relevant features, of which the top 5 ranked features were for model training and classification. In addition to the proposed Decision Tree (DT), post-pruned and unpruned Decision Trees (DT) were evaluated using the agnostic chi-square method. The performance stability of all comparison models was evident in this subset of the top 5 data features. The proposed framework consistently outperformed all other comparison algorithms across the considered performance metrics, with the combined benefits of the lowest training and test times, accuracy, recall, f1-score, and precision.This technique improves learning capabilities to reduce execution time, FAR, and computational complexity. Additionally, feature selection dynamically matches network traffic. Subsequently, the suitability of the proposed technique for both ML and DL models for classification was verified by applying the selected subset of data features to four different state-of-the-art ML classifiers and four DL models. Extensive experiments on various models aim to verify the feasibility of the proposed agnostic CH-DT and its interoperability in Supervisory Control and Data Acquisition (SCADA) networks. Furthermore, the present invention examines the WUSTL-IIoT-2018, NSL-KDD, and CICIDS2018 datasets to verify the reliability of the proposed agnostic CH-DT technique across various scenarios involving multiple attack types. This approach efficiently selects the most relevant data features by ranking top features and classifying network traffic into a reliable subset of the dataset. By utilizing the high-dimensional ICS-SCADA and WUSTL-IIoT-2018 datasets and two publicly available cybersecurity datasets, the proposed agnostic CH-DT model was efficient and reliable in selecting the most important data functions in SCADA networks and was effective in attack detection and classification. Experimental results showed that the performance of the proposed CH-DT technique was consistently significant across the WUSTL-IIoT-2018, ICS-SCADA, NSL-KDD, and CICIDS2018 datasets.

[0152] As such, those skilled in the art to which the present invention pertains will understand that the present invention may be implemented in other specific forms without altering its technical concept or essential features. Therefore, the embodiments described above should be understood as illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims set forth below rather than by the detailed description above, and all modifications or variations derived from the meaning and scope of the claims and their equivalents should be interpreted as being included within the scope of the present invention. Explanation of the symbols

[0154] 10 : Data Preprocessing Section 20 : Agnostic Chi-square Processing Unit 30: Tree Algorithm Processing Unit 40: Detection and Classification Unit

Claims

Claim 1 delete Claim 2 A data preprocessing unit for organizing data with zero, null, and infinity values ​​in a Supervisory Control and Data Acquisition (SCADA) dataset of an Industrial Control System (ICS); an agnostic chi-square processing unit for classifying data preprocessed by the data preprocessing unit through an agnostic chi-square with a predetermined p-value threshold; and an algorithm processing unit for processing the data classified by the agnostic chi-square processing unit using a pre-organized decision tree algorithm. A high-dimensional intrusion detection system for a high-trust communication network, comprising: a detection and classification unit that analyzes communication network traffic processed by the algorithm processing unit and classifies it into benign and malicious events; wherein the algorithm processing unit processes pre-pruning to a maximum depth of 20 in the decision tree algorithm, and the optimal pre-pruned decision tree layer uses an optimal subset determined through agnostic chi-square analysis for detection and classification, and the agnostic chi-square processing unit is not dependent on the model and promotes model interoperability so as to be easily integrated with a selected classifier. Claim 3 A high-dimensional intrusion detection system for a high-trust communication network, wherein, in paragraph 2, the agnostic chi-square processing unit uses an agnostic chi-square with a p-value threshold of 0.

05. Claim 4 delete

Images