The proposed system is a hybrid intrusion detection system for industrial control systems (ICS). Depending on different application scenarios, supervised or semi-supervised IDS can be used. The supervised IDS is assisted by implementation of virtual honeypot and physical honeypot for collecting attack data. Genetic sequence clustering and LSTM deep learning algorithms are then used to distinguish normal behaviors from malicious behaviors. In case of lacking attack data for training supervised model, we provide semi-supervised model in our system to solve this problem. K-means and Convolutional Autoencoder are used first in semi-supervised model to learn normal behaviors of ICS and then used to detect abnormal behaviors. The experimental results show that the proposed method outperforms other methods in almost all performance metrics. The proposed system can be used in many ICS applications such as natural gas pipelines, water supply systems, and smart grids.

The proposed system provides supervised and semi-supervised intrusion detection mechanisms with virtual honeypots and high-interaction physical honeypots for different ICS application scenarios in which attack data may or may not be easy to collect. The supervised IDS is assisted by implementation of virtual honeypot and physical honeypot for collecting attack data. Genetic sequence clustering and LSTM deep learning algorithms are then used to distinguish normal behaviors from malicious behaviors. In case of lacking attack data for training supervised model, we provide semi-supervised model in our system to solve this problem. K-means and Convolutional Autoencoder are used first in semi-supervised model to learn normal behaviors of ICS and then used to detect abnormal behaviors. The experimental results show that the proposed method outperforms other methods in almost all performance metrics.

The proposed system provides supervised and semi-supervised intrusion detection mechanisms with virtual honeypots and high-interaction physical honeypots for different ICS application scenarios in which attacks may come from inside or outside of control system networks. The experimental results show that the proposed method outperforms other methods in almost all performance metrics. The proposed system can be used in many ICS applications such as semiconductor industries, natural gas pipelines, water supply systems, and smart grids.