Optimization of the novelty detection model based on LSTM autoencoder for ICS environment

Abstract

The recent evolution in cybersecurity shows how vulnerable our technology is. In addition, contemporary society becoming more reliant on “vulnerable technology”. This is especially relevant in case of critical information infrastructure, which is vital to retain the functionality of modern society. Furthermore, the cyber-physical systems as Industrial control systems are an essential part of critical information infrastructure; and therefore, need to be protected. This article presents a comprehensive optimization methodology in the field of industrial network anomaly detection. We introduce a recurrent neural network preparation for a one-class classification task. In order to optimize the recurrent neural network, we adopted a genetic algorithm. The main goal is to create a robust predictive model in an unsupervised manner. Therefore, we use hyperparameter optimization according to the validation loss function, which defines how well the machine learning algorithm models the given data. To achieve this goal, we adopted multiple techniques as data preprocessing, feature reduction, genetic algorithm, etc. © Springer Nature Switzerland AG 2019.