Enhanced SCADA IDS Security by Using MSOM Hybrid Unsupervised Algorithm

Abstract

Self-organizing maps (SOM) are unsupervised neural networks that cluster high dimensional data and transform complex inputs into easily understandable inputs. To find the closest distance and weight factor, it maps high dimensional input space to low dimensional input space. The closest node to data point is denoted as a neuron. It classifies the input data based on these neurons. The reduction of dimensionality and grid clustering using neurons makes to observe similarities between the data. In the proposed mutated self-organizing maps (MSOM) approach, the authors have two intentions. One is to eliminate the learning rate and to decrease the neighborhood size, and the next one is to find out the outliers in the network. The first one is by calculating the median distance (MD) between each node with its neighbor nodes. Then those median values are compared with one another. If any of the MD values significantly varies from the rest, they are declared as anomaly nodes. In the second phase, they find out the quantization error (QE) in each instance from the cluster center.