ZuraNet: a hybrid rule-based intrusion detection system with deep learning for securing SCADA-driven cyber-physical systems

Abstract

Cyber-Physical Systems (CPS) are the backbone of industrial and critical infrastructure applications in today’s world, especially in Supervisory Control and Data Acquisition (SCADA) systems. Security of the SCADA environment is important because any vulnerability can cause disastrous results, such as breakdowns in operations and loss of funds. Nonetheless, current Intrusion Detection Systems (IDS) are confronted with the effective detection of sophisticated cyberattacks. For this purpose, a hybrid rule-based IDS using deep learning methods, tailored for intrusion detection in SCADA-controlled CPS, is suggested in this paper. The key contribution of this research is the establishment of two novel models, which are ZuraNet and GRiQ-Net. The ZuraNet model utilizes deep learning methods for improving advanced attack pattern detection and keeping rule-based systems interpretable. The GRiQ-Net method uses residual learning as well as query-based operations to capture effectively both short-range and long-range SCADA network traffic dependencies. The suggested models were comprehensively verified on various benchmark datasets, i.e., ToN-IoT, RT-IoT 2022, CICIDS2017, CIRA-CIC-DoHBrw-2020, and ICS-SCADA. The experimental performance suggests that the hybrid IDS is considerably superior to current security models with respect to precision, detection rate, and accuracy. The ZuraNet and GRiQ-Net models attained accuracy rates of as high as 99.60%, with precision of more than 99% and detection rates of more than 99.35%, thus proving the superior capability for anomaly detection with reduced false positives. The models also entail low processing times, thus ensuring real-time applicability for SCADA systems. In general, the suggested hybrid IDS architecture is an important contribution to CPS security through its offering of an intelligent, adaptive, and high-performance real-time intrusion detection solution.