Machine Learning Algorithms for Identifying Dependencies in OT Protocols

Milosz Smolarczyk (), Jakub Pawluk, Alicja Kotyla, Sebastian Plamowski, Katarzyna Kaminska and Krzysztof Szczypiorski
Additional contact information
Milosz Smolarczyk: Research & Development Department, Cryptomage LLC, St. Petersburg, FL 33702, USA
Jakub Pawluk: Research & Development Department, Cryptomage SA, 50-556 Wrocław, Poland
Alicja Kotyla: Research & Development Department, Cryptomage SA, 50-556 Wrocław, Poland
Sebastian Plamowski: Institute of Control and Computation Engineering, Warsaw University of Technology, 00-661 Warsaw, Poland
Katarzyna Kaminska: Research & Development Department, Cryptomage SA, 50-556 Wrocław, Poland
Krzysztof Szczypiorski: Research & Development Department, Cryptomage SA, 50-556 Wrocław, Poland

Energies, 2023, vol. 16, issue 10, 1-24

Abstract: This study illustrates the utility and effectiveness of machine learning algorithms in identifying dependencies in data transmitted in industrial networks. The analysis was performed for two different algorithms. The study was carried out for the XGBoost (Extreme Gradient Boosting) algorithm based on a set of decision tree model classifiers, and the second algorithm tested was the EBM (Explainable Boosting Machines), which belongs to the class of Generalized Additive Models (GAM). Tests were conducted for several test scenarios. Simulated data from static equations were used, as were data from a simulator described by dynamic differential equations, and the final one used data from an actual physical laboratory bench connected via Modbus TCP/IP. Experimental results of both techniques are presented, thus demonstrating the effectiveness of the algorithms. The results show the strength of the algorithms studied, especially against static data. For dynamic data, the results are worse, but still at a level that allows using the researched methods to identify dependencies. The algorithms presented in this paper were used as a passive protection layer of a commercial IDS (Intrusion Detection System).

Keywords: cybersecurity; machine learning; XGBoost; EBM; GAM; Modbus TCP/IP (search for similar items in EconPapers)
JEL-codes: Q Q0 Q4 Q40 Q41 Q42 Q43 Q47 Q48 Q49 (search for similar items in EconPapers)
Date: 2023
References: View references in EconPapers View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1996-1073/16/10/4056/pdf (application/pdf)
https://www.mdpi.com/1996-1073/16/10/4056/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jeners:v:16:y:2023:i:10:p:4056-:d:1145709

Access Statistics for this article

Energies is currently edited by Ms. Agatha Cao

More articles in Energies from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().