SCADA intrusion detection using deep factorization machines

The rapid assimilation of Supervisory Control and Data Acquisition (SCADA) systems into Industrial Internet of Things (IIoT) systems has exposed them to advanced cyberattacks with potentially devastating impacts on critical industrial processes and functionalities. Traditional methods of intrusion detection, including signature-based detection, statistical anomaly-based detection, and classical machine learning techniques, can become overwhelmed by the sheer scale of high-dimensional feature spaces and the nonlinear patterns of attacks. To address these limitations, this paper presents a Deep Factorization Machine (DeepFM)-based intrusion detection scheme, specifically designed for SCADA systems. As a novelty of DeepFM, the framework integrates the advantage of factorization machines in modeling low-order interactions of features with deep neural networks to capture high-order representations, thereby improving performance in detection tasks in complex IIoT environments. The framework is tested on four benchmark datasets, namely WUSTL-IIoT-2018, WUSTL-IIoT-2021, HAI (HIL-based Augmented ICS) Security, and the Sherlock dataset. Moreover, the experimental results demonstrate that the recommended approach outperforms others in various conditions. On our WUSTL-IIoT-2018 dataset, DeepFM achieves nearly perfect accuracy of 99.98% with an F1-score of 0.9997, significantly outperforming conventional baselines. In WUSTL-IIoT-2021, the accuracy score is high, 98.72 percent, with strong recall (0.9765) and the F1-score (0.9945). On HAI data, it obtains the accuracy of 95.6%, precision of 0.967, and recall of 0.973. On the Sherlock dataset, the model maintains 95.4% accuracy and an F1-score of 0.955. These findings not only prove the flexibility, resilience, and scalability of DeepFM in SCADA intrusion detection but also confirm that the method is suitable for application in a wide range of systems. The proposed framework is more effective than traditional approaches and should be considered a practical solution for integrating security into IIoT infrastructures. Future work will focus on real-time deployment, optimizing edge devices, and defensive measures against attacks.