Keywords

1 Introduction

Cyber-Physical Systems (CPS) are defined as systems in which a tight integration between the real-world and cyberspace exists [1]. Cyberspace is the virtual medium responsible for facilitating interconnections between users through telecommunications and computers to store, modify, or exchange data [2]. Once a CPS device is connected to the internet, it is referred to as the Internet of Things (IoT) [3]. IoT allows the interaction and cooperation of inter-networked physical objects to collect and exchange data over the Internet [4]. Advancements in IoT devices are urging traditional manufacturing systems to be integrated into cyberspace to take advantage of this emerging interaction and cooperation [5]. These systems are then can be replaced by a geographically dispersed network of services that are connected to the shop floor through the power of IoT. This spread or decentralization in manufacturing systems can help with providing more flexibility, agility, and adaptivity through a faster responsivity in processing shop floor data and thus can effectively overcome the challenges corresponding with traditional manufacturing systems. However, this higher connectivity can come at the cost of an increase in the number of cyber-attacks [6,7,8]. These attacks showed that given enough resources, all systems can be breached, with manufacturing systems being no exception with one in every three cyber-physical attacks happening in the manufacturing sector according to the Industrial Control Systems Monito Newsletter issued by the U.S. Department of Homeland Security [9, 10]. The rapid occurrence of such attacks on manufacturing and business operations and their information systems and the resulting damages and costs associated with them have urged scholars to consider new ways of detecting such attacks [11]. As the continuation of such efforts, we intend to show how appropriate machine learning approaches can be utilized to enhance the deterrence level of malicious attacks in industrial IoT devices in manufacturing. To this end, we have implemented a set of preprocessing and data analytics techniques on a new dataset in which various cyber-security attacks have been successfully detected via classification algorithms.

2 Background

Machine learning methods have been applied in many aspects of today’s manufacturing enterprises. Many scholars are now focusing on the use of these techniques to improve cybersecurity by monitoring and conducting surveillance of real-time network streams and real-time detection of threat patterns [12]. These methods can learn from historical data and train a model to correlate events, identify patterns, and detect anomalous behavior. Apart from the algorithm implementation and development, various efforts have been put forward by researchers in this field to simulate breach scenarios and record the subsequent data. These studies have resulted in a variety of data sets existing in the field within each different pre-processing technique have been coupled. As a result, a detailed literature review is needed to summarize the state-of-the-art of the field and identify the potential areas of improvement. The following paragraphs summarize the most notable research works done in this field to date.

Terzi, Terzi & Sagiroglu [13] have used an unsupervised anomaly detection approach and Principal Component Analysis (PCA) to identify anomalies in public big network data to understand network behavior to distinguish cyber-attacks and to provide better detection in the future. Autoencoder has been used with dimension reduction to detect cyber-attack anomalies [14]. In another study, Wan et al. [15] showed that using Wavelet Neural Network (WNN) to detect anomalies in industrial control communication systems can lead to better accuracy compared to using Back Propagation Neural Network (BPNN) in addition to being more adequate in real-time analysis.

The denial of service category (DoS) in KDD CUP 1999 (KDD) and CSE-CIC-IDS2018 data sets have been used by Kim et al. [15] to develop Convolutional Neural Network (CNN) models to detect DoS intrusion attacks resulting in a high accuracy detection that ranged between 89%–99%. Wang et al. [16], McLaughlin et al.[17], and Gibert [18] have also used a CNN approach to detect malware. The latter evaluated their technique using the MalImg dataset and the Microsoft Malware Classification Challenge dataset and managed to outperform other methods in terms of accuracy and classification time.

Deep Neural Network (DNN) has been deployed to detect malware [19] on large scales data sets such as the Internal Microsoft dataset with over 2.6 million labeled samples with results for a two-class error rate of 0.49% for a single neural network and 0.42% for an ensemble of neural networks [20]. Xu et al. [21] combined DNN with Multiple Kernel Learning (MKL) to detect malware in applications run by users of Android devices. Aside from the aforementioned studies, there exist other studies that attempt to address the problem from aspects other than algorithm development. For instance, Elhabashy et al. [9] have proposed an attack taxonomy to better understand the relationships between quality control systems, manufacturing systems, and cyber-physical attacks. In another study, Wu et al. [22] have utilized anomaly detection and Random Forest algorithm to detect 3D printing and CNC milling machine malicious attacks.

3 Dataset and Methodology

In this paper, we used a dataset called “N-BaIoT” that was initially generated by Meidan et al. from network traffic patterns [23]. The initial data was gathered from nine commercial IoT devices infected by two different botnets. They have deployed two of the most common IoT botnet families namely, Gafgyt and Mirai, and collected traffic data before and after the infection. Gafgyt (also known as BASHLITE, Q-Bot, Torlus, LizardStresser, and Lizkebab) is one of the most infamous types of IoT botnets. To launch an attack, the botnet infects Linux-based IoT devices by brute-forcing default credentials of devices with open Telnet ports. Mirai is the second botnet that has been deployed in this isolated network. The experimental setup included a C&C server and a server with a scanner and loader. The scanner and loader components were responsible for scanning and identifying vulnerable IoT devices, and loading the malware to the vulnerable IoT devices detected. Once a device was infected, it automatically started scanning the network for new victims while waiting for instructions from the C&C server [23]. In our analysis, we only use seven of the devices out of the nine that exist in this data set. We have implemented and chosen the most effective classifiers for this specific data set which turned out to be KNN, DT, and RF. A brief description of these algorithms is described below:

  1. 1.

    K-Nearest Neighbors (KNN): KNN is a supervised machine learning algorithm that can be used to solve both classification and regression problems. KNN assumes that similar data points exist nearby. In other words, similar data points are near to each other. KNN searches the entire data set for the k number of most neighbors and calculates distances for proximities before sorting the calculated distances in ascending order from smallest to largest and picking the first K with its feature that is associated with the smallest distance. KNN uses a large amount of training data, where data points are plotted in a high-dimensional space, where each axis in the space corresponds to an individual variable that characterizes that data point [24]. KNN has been used in intelligent mechanical systems to detect online fraud [25] and has been successfully implemented in a large number of business problems [26, 27].

  2. 2.

    Decision Tree (DT): DT is a set of rules for dividing a large heterogeneous population into smaller, more homogeneous groups concerning a particular output feature. DT is one of the most common Data Mining (DM) techniques that is widely being used for both classification and regression analysis. DT comes in many types of decision algorithms, some of which are binary trees that always produce two categories (binary-split) at any level of the tree-like CART and QUEST. Others like CHAID and C5.0 are non-binary trees that often produce more than two categories at any level in the tree. Other minor differences exist between these four main DT algorithms such as, how to deal with missing value, variable selection, capacity to handle a huge number of classes in variables, and pruning methods [28,29,30]. DT has been used in phishing detection [31] and Adversarial detection [32].

  3. 3.

    Random Forest (RF): RF is a type of ensemble learning method that have been widely used in many fields, such as computer vision and data mining. MRF performs very well with a large data set in a short time compared with other techniques. MRF is easy to interpret and understand, can handle both numerical and categorical data. MRF consists of a large number of individual decision trees that operate as a group producing a single effect (ensemble). Each decision tree is built by randomly selecting observations and specific features and averaging the results at the end. Thus, allowing it to limit overfitting without a substantial increase in the generalization error [33, 34]. RF has been used to detect ransomware and achieved a high accuracy level of 97.74% in detecting ransomware [35]. At the same time, RF was used as a feature selection tool when building an Auto-Encoder Intrusion Detection System (AE-IDS). The results showed that using RF helped in reducing the detection time and effectively improved the prediction accuracy [36].

4 Results and Discussion

A 90/10 split has been used to form the training and test data sets considering the large scale of the data set. Also, in all of the experiments, a 5-fold cross-validation has been used for model validation. The accuracy results for each of these classifiers can be found in Fig. 1. As one can see from Fig. 1, the algorithms have been implemented on three different IoT devices (Ecobee Thermostat, Philips B120N10 Baby Monitor, and Provision PT737E Security Camera) compromised by two different bots (Mirai, and Gafgyt). The results indicate that the determining factor in the final accuracy of attack classification is the type of bot rather than the device type. In other words, the accuracy results show a similar pattern among three different devices compromised by a similar bot. According to the results, for devices attacked by Mirai bot, RF algorithm delivers the highest accuracy followed by the DT, and KNN. In particular, the accuracy achieved by the KNN algorithm dealing with the Thermostat compromised by the Mirai bot is the lowest among any other scenarios as this algorithm is only capable of accurately classifying the data in 0.755426 of the test data instances. This translates to a significant number of misclassification instances (12846 out of the 52525 instances in the test dataset) which underlines the poor performance of this algorithm in this specific scenario. On the other hand, for the Gafgyt bot, RF outperforms the other two algorithms while DT performs worst among them. As opposed to the left-hand side scenarios corresponding with the Mirai bot, even the worst-performing algorithm dealing with the Gafgyt bot (DT) is capable of accurately classifying the attacks in more than 0.99 of the test data instances.

It is important to note that even though the accuracy values for different algorithms look reasonably close, they translate to a significantly different number of misclassifications due to the large size of the dataset. This can be very critical in real-world scenarios as even a single cyber-security breach can result in a significant amount of loss from security and/ or economic points of view. The corresponding misclassification values can be found in Table 1.

Fig. 1.
figure 1

Accuracy results for three algorithms detecting six different device and bot type combinations.

Full size image
Table 1. Misclassification results.
Full size table

5 Conclusion

We proposed a machine learning-based framework for attack classification and detection in IIoT devices. The experiments have shown the successful adoption of artificial intelligence to cybersecurity, which has led to an effective and robust approach for identifying, classifying, and detecting two different types of botnet attacks compromising three different IIoT devices. The evaluation process has employed accuracy as a performance metric to show the effectiveness of this approach. The experiments have demonstrated that a combination of various machine learning algorithms is capable of accurately detecting and classifying the attacks in more than 99.9% of the instances in the test data set employed. Future endeavors can focus on enhancing our approach by developing deep neural network-based models and also taking advantage of other emerging IIoT data sets. Future work can also attempt to develop more effective feature engineering methods that can transform the raw network data into richer input sources for building learning methods.