Stage-Zero: A Dynamic Ensemble Method for Intrusion Detection in Industrial Control Systems

Industrial control systems (ICS) have become increasingly vulnerable to security risks due to the proliferation of network applications. Intrusion detection systems (IDS) are employed to safeguard ICS from hostile attacks. While machine learning-based methods perform well in intrusion detection tasks, combining multiple machine learning classifiers can further increase the detection accuracy. Confidence calibration is a technique developed to enable a machine learning model to produce prediction results along with more accurate proximate correctness likelihood. This study proposes a dynamic ensemble method that utilizes confidence calibration and a zeroth layer neural net classifier to create a semi-stacked ensemble model, while weighted cross-entropy loss is employed to balanced training samples. We tested our method on two real ICS cybersecurity datasets and achieved accuracy that matches traditional aggregating ensembles like voting and stacking while significantly reducing inference computation.