Evaluation of scalable fair clustering machine learning methods for threat hunting in cyber-physical systems

Abstract

With a rapid increase in the automation of industrial control systems, it has become vital to defend them against cyberattacks. Clustering is a widely used, unsupervised machine learning technique to detect malware from behavior data of control systems. Clustering algorithms can be susceptible to amplifying biases that may be present in the input datasets. Recent works in fair clustering attempt to solve this problem by making them balanced with respect to certain sensitive attributes. The fair k-median clustering is a newly developed technique that allows the assignment of input points to clusters such that the number of each type of point is balanced as per the fairness criteria. In this experiment, we have selected a recent work that implements a fair and scalable k-median clustering algorithm with near-linear runtime. We test our system on 4 new datasets belonging to IoT and Water distribution systems and evaluate the performance and accuracy of our results.