A Dynamic Hybrid IDS for APT Detection in ICS Using Deep Neural Networks
摘要
As the Internet of Things (IoT) continues to expand, its integration into critical infrastructure systems, such as Supervisory Control and Data Acquisition (SCADA), has introduced significant cybersecurity challenges. Among these, Advanced Persistent Threat (APT) attacks pose a severe risk due to their sophisticated and targeted nature. Traditional intrusion detection systems (IDS) often struggle to detect such threats effectively, particularly in resource-constrained IoT environments. This paper proposes a dynamic hybrid IDS model that combines a modified Convolutional Neural Network (CNN) with Bidirectional Long Short-Term Memory (Bi-LSTM) and integrates the Hurst parameter for enhanced detection of APT in SCADA systems. The Hurst parameter, which quantifies self-similarity in network traffic, is leveraged to improve the detection of APT attacks. The proposed model is evaluated using the CICIDS2017 dataset, achieving an accuracy of 96.42%. The results demonstrate the model’s superior performance in identifying malicious traffic, offering a robust solution for securing SCADA systems against one of the most evolving cyber-attacks APT.