Deep Reinforcement Learning Based Cyberattack Detection in Supervisory Control and Data Acquisition System

The cybersecurity landscape is continuously evolving and dynamic, as new attackers develop increasingly sophisticated methods to attack the targeted organizations. Traditional cybersecurity strategies focused mainly on safeguarding the information using the core principles of the Confidentiality, Integrity, and Availability i.e. CIA triad. However, in Supervisory Control and Data Acquisition (SCADA) systems, existing intrusion detection mechanisms have certain limitations when it comes to identifying the abnormalities effectively. Researchers have widely explored different types of Machine Learning (ML) techniques and Deep Learning (DL) algorithms to detect the threats faced by Industrial Control Systems (ICS). Although these techniques have provided some level of protection, they have proven to be insufficient in fully securing these systems against evolving cyber threats. To tackle this problem, we propose a novel approach based on Deep Reinforcement Learning (DRL) to amplify the identification of cyber-attacks in SCADA networks. Our model proposes the “SARSA algorithm,” a model-free reinforcement learning technique designed to evaluate the state-action value pairs. SARSA employs an on-policy strategy, it learns from the actions currently taken according to the ongoing policy, allowing for proactive and adaptive intrusion detection. It updates the value in regards to the action selected by the ongoing policy. This approach allows for immediate updates, enabling our model to adapt and respond to intrusions more efficiently. For validation, we use the WUSTL-IIOT- 2021 dataset, a publicly available dataset that includes twenty-five number of networking features representing both attack traffic and benign. Experimental results illustrate that our proposed algorithm achieved a good accuracy in detecting the cyber threats and highlights the hypothetical SARSA-based techniques to strengthen the security of critical infrastructure.