Scholarlink

<p>The adoption of IoT and cyber-physical systems (CPSs) in smart homes and critical infrastructures has led to the&#xa0;possibility of&#xa0;physical damage from system compromises. Security failures in sectors like power, transport, and public safety can have more severe physical impacts than just information loss. Intrusion detection systems (IDSs) are crucial in a defense-in-depth approach. We propose a detection engine to prevent CPS from transitioning into unsafe states beyond critical limits, thresholds, and behavioral normalicies. A novel host-based IDS using a mixture-of-experts (MoE) model is introduced in the CPS security paradigm. For signature-based protection, we developed a context-aware CPS-SNORT ruleset for deep packet inspection (DPI) of Gcode instructions (NIST RS-274/ISO 6983-1:2009) used in numerical control of machines like CNCs and 3D printers. A new Gcode dataset was developed on a CPS test bed. In a supervised learning approach, we achieved over 99% accuracy with random tree for known attack detection. In a semi-supervised approach, logistic regression achieved 85% accuracy. For behavioral anomaly detection, LSTM achieved 99.9% accuracy, outperforming isolation forest and local outlier factor.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Integrating contextual intelligence with mixture of experts for signature and anomaly-based intrusion detection in CPS security

  • 期刊论文

  • 发表日期：

    2025年1月7日

查看全文
  • Kashif Rahim,
  • Zia Ul Islam Nasir,
  • Nassar Ikram,
  • Hassaan Khaliq Qureshi

摘要

The adoption of IoT and cyber-physical systems (CPSs) in smart homes and critical infrastructures has led to the possibility of physical damage from system compromises. Security failures in sectors like power, transport, and public safety can have more severe physical impacts than just information loss. Intrusion detection systems (IDSs) are crucial in a defense-in-depth approach. We propose a detection engine to prevent CPS from transitioning into unsafe states beyond critical limits, thresholds, and behavioral normalicies. A novel host-based IDS using a mixture-of-experts (MoE) model is introduced in the CPS security paradigm. For signature-based protection, we developed a context-aware CPS-SNORT ruleset for deep packet inspection (DPI) of Gcode instructions (NIST RS-274/ISO 6983-1:2009) used in numerical control of machines like CNCs and 3D printers. A new Gcode dataset was developed on a CPS test bed. In a supervised learning approach, we achieved over 99% accuracy with random tree for known attack detection. In a semi-supervised approach, logistic regression achieved 85% accuracy. For behavioral anomaly detection, LSTM achieved 99.9% accuracy, outperforming isolation forest and local outlier factor.