Intrusion detection algorithm based on OCSVM in industrial control system. Issue 10 (10th December 2015)

• Record Type: Journal Article
• Authors: Shang, Wenli; Zeng, Peng; Wan, Ming; Li, Lin; An, Panfeng
• Is Part Of: Security and communication networks. Volume 9:Issue 10(2016)
• Page Start: 1040
• Page End: 1049
• Publication Date: 2015-12-10
• Subjects: SVM -- intrusion detection -- PSO; Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1002/sec.1398
• Languages: English
• ISSNs: 1939-0114

Abstract

Abstract: In order to detect abnormal communication behaviors efficiently in today's industrial control system, a new intrusion detection algorithm based on One‐Class Support Vector Machine (OCSVM) is proposed in this paper. In this algorithm, a normal communication behavior model is established by using OCSVM, and the Particle Swarm Optimization algorithm is designed to optimize OCSVM model parameters. Furthermore, we adopt the normal Modbus function code sequence to train OCSVM model, and then use this model to detect abnormal Modbus TCP traffic. Our simulation results show that the proposed algorithm not only is efficient and reliable but also meets the real‐time requirements of anomaly detection in industrial control system. Copyright © 2015 John Wiley & Sons, Ltd. Abstract : The intrusion detection system is established by using OCSVM algorithm, and the PSO is used to optimize parameters, which can detect the potential attack in multiple Modbus packets and has a better detection performance.