TabGAN-Powered Data Augmentation and Explainable Boosting-Based Ensemble Learning for Intrusion Detection in Industrial Control Systems

In the era of Industry 4.0, the Industrial Control System (ICS) plays a crucial role, making the detection of cyber attacks on it both vital and challenging. This study presents TDAELID, a method designed to improve cyber assault detection on the widely used IEC 60870-5-104 protocol in ICS. TDAELID employs TabGAN to generate realistic samples from minority classes and a clustering approach to select representative samples from majority classes, enhancing the quality of the training set. Furthermore, it utilizes a weighted ensemble of multiple AI models concurrently to enhance intrusion detection effectiveness. Evaluation on the IEC 60870-5-104 Intrusion Detection Dataset demonstrates TDAELID’s superiority over state-of-the-art methods, achieving an 85.44% detection accuracy and an 84.88% F1 score, surpassing SOTA methods.