Sahu Abhijeet, Davis Katherine
Electrical Engineering Department, Texas A&M University, College Station, TX 77843, USA.
Sensors (Basel). 2022 Mar 9;22(6):2100. doi: 10.3390/s22062100.
False alerts due to misconfigured or compromised intrusion detection systems (IDS) in industrial control system (ICS) networks can lead to severe economic and operational damage. However, research using deep learning to reduce false alerts often requires the physical and cyber sensor data to be trustworthy. Implicit trust is a major problem for artificial intelligence or machine learning (AI/ML) in cyber-physical system (CPS) security, because when these solutions are most urgently needed is also when they are most at risk (e.g., during an attack). To address this, the Inter-Domain Evidence theoretic Approach for Inference (IDEA-I) is proposed that reframes the detection problem as how to make good decisions given uncertainty. Specifically, an evidence theoretic approach leveraging Dempster-Shafer (DS) combination rules and their variants is proposed for reducing false alerts. A multi-hypothesis mass function model is designed that leverages probability scores obtained from supervised-learning classifiers. Using this model, a location-cum-domain-based fusion framework is proposed to evaluate the detector's performance using disjunctive, conjunctive, and cautious conjunctive rules. The approach is demonstrated in a cyber-physical power system testbed, and the classifiers are trained with datasets from Man-In-The-Middle attack emulation in a large-scale synthetic electric grid. For evaluating the performance, we consider plausibility, belief, pignistic, and general Bayesian theorem-based metrics as decision functions. To improve the performance, a multi-objective-based genetic algorithm is proposed for feature selection considering the decision metrics as the fitness function. Finally, we present a software application to evaluate the DS fusion approaches with different parameters and architectures.
工业控制系统（ICS）网络中由于入侵检测系统（IDS）配置错误或遭到破坏而产生的误报，可能会导致严重的经济和运营损失。然而，利用深度学习来减少误报的研究通常要求物理和网络传感器数据是可信的。在网络物理系统（CPS）安全中，隐式信任是人工智能或机器学习（AI/ML）面临的一个主要问题，因为在最急需这些解决方案的时候，它们也最容易受到威胁（例如，在攻击期间）。为了解决这个问题，提出了域间证据理论推理方法（IDEA-I），该方法将检测问题重新定义为在存在不确定性的情况下如何做出正确决策。具体而言，提出了一种利用Dempster-Shafer（DS）组合规则及其变体的证据理论方法来减少误报。设计了一种多假设质量函数模型，该模型利用从监督学习分类器获得的概率分数。利用这个模型，提出了一个基于位置和域的融合框架，使用析取、合取和谨慎合取规则来评估检测器的性能。该方法在一个网络物理电力系统测试平台上得到了验证，并且使用来自大规模合成电网中中间人攻击仿真的数据集对分类器进行了训练。为了评估性能，我们将似然性、可信度、信度概率和基于一般贝叶斯定理的指标作为决策函数。为了提高性能，提出了一种基于多目标的遗传算法用于特征选择，将决策指标作为适应度函数。最后，我们展示了一个软件应用程序，用于评估具有不同参数和架构的DS融合方法。
