Anomaly Detection in SCADA Industrial Control Systems Using Bi-Directional Long Short-Term Memory

In the modern era, industries are migrating to Industry 4.0 in the aspects of smarter and faster with efficiency to increase productivity to attain a profit. Thus, it becomes a part of Cyber-Physical Systems (CPS) which is connected to the internet and pays a path for intrusion in the networks when dealing with the network traffic of ICS. In this paper, we evaluated the Industrial Control Systems (ICS)/Supervisory Control and Data Acquisition (SCADA) Cyber Attack New Gas Pipeline Dataset from Mississippi State University with specialized two-time-series Recurrent Neural Network architectures of Deep Learning for anomaly detection which will act as an Intrusion Detection System (IDS). Here, we used two-time-series models: Bi-LSTM (Bi-directional long short-term memory) and Bi-GRU (Bi-directional Gated recurrent units) were used along with the LOCF (Last Observation Carried Forward) pre-processing technique to fill out the gaps and SMOTE (Synthetic Minority Oversampling Technique) for balancing the dataset. The main contribution of this paper involves identifying the attack type and its location related to specific attack classification apart from binary and category attacks classification which helps in preventing processing downtime from the zero-day exploits. Bi-LSTM outperforms better in all three types of attacks such as Binary (97.78%), Category (95.56%), and Specific (95.40%) in terms of accuracy metrics compared to Bi-GRU and other Deep learning methods. However, computation time is a trade-off between Bi-LSTM and Bi-GRU, resulting in more or less similar results.