Multi-step attack detection in industrial networks using a hybrid deep learning architecture

TLDR

Industrial networks face frequent high‑impact attacks, yet current security systems react only after breaches and fail to prevent them, making proactive detection essential to avoid malfunctions, disruptions, data loss, and theft. The study aims to develop intrusion detection algorithms that automatically adapt to the continuous operation and evolving conditions of industrial networks. The authors propose a hybrid deep‑learning model combining convolutional neural networks and deep belief networks, evaluated on the Multi‑Step Cyber Attack dataset using multiple performance metrics.

Abstract

<abstract><p>In recent years, the industrial network has seen a number of high-impact attacks. To counter these threats, several security systems have been implemented to detect attacks on industrial networks. However, these systems solely address issues once they have already transpired and do not proactively prevent them from occurring in the first place. The identification of malicious attacks is crucial for industrial networks, as these attacks can lead to system malfunctions, network disruptions, data corruption, and the theft of sensitive information. To ensure the effectiveness of detection in industrial networks, which necessitate continuous operation and undergo changes over time, intrusion detection algorithms should possess the capability to automatically adapt to these changes. Several researchers have focused on the automatic detection of these attacks, in which deep learning (DL) and machine learning algorithms play a prominent role. This study proposes a hybrid model that combines two DL algorithms, namely convolutional neural networks (CNN) and deep belief networks (DBN), for intrusion detection in industrial networks. To evaluate the effectiveness of the proposed model, we utilized the Multi-Step Cyber Attack (MSCAD) dataset and employed various evaluation metrics.</p></abstract>