Nowadays, with the rapid development of industrial Internet technology, on the one hand, advanced industrial control systems (ICS) have improved industrial production efficiency. However, there are more and more cyberattacks targeting industrial control systems. To ensure the security of industrial networks, intrusion detection systems have been widely used in industrial control systems, and deep neural networks have always been an effective method for identifying cyber attacks. Current intrusion detection methods still suffer from low accuracy and a high false alarm rate. Therefore, it is important to build a more efficient intrusion detection model. This paper proposes a hybrid deep learning intrusion detection method based on convolutional neural networks and bidirectional long short-term memory neural networks (CNN-BiLSTM). To address the issue of imbalanced data within the dataset and improve the model’s detection capabilities, the Synthetic Minority Over-sampling Technique-Edited Nearest Neighbors (SMOTE-ENN) algorithm is applied in the preprocessing phase. This algorithm is employed to generate synthetic instances for the minority class, simultaneously mitigating the impact of noise in the majority class. This approach aims to create a more equitable distribution of classes, thereby enhancing the model’s ability to effectively identify patterns in both minority and majority classes. In the experimental phase, the detection performance of the method is verified using two data sets. Experimental results show that the accuracy rate on the CICIDS-2017 data set reaches 97.7%. On the natural gas pipeline dataset collected by Lan Turnipseed from Mississippi State University in the United States, the accuracy rate also reaches 85.5%.

With rapid development of Internet, network security issues become increasingly serious. Temporary patches have been put on the infectious hosts, which may lose efficacy on occasions. This leads to a time delay when vaccinated hosts change to susceptible hosts. On the other hand, the worm infection is usually a nonlinear process. Considering the actual situation, a variable infection rate is introduced to describe the spread process of worms. According to above aspects, we propose a time-delayed worm propagation model with variable infection rate. Then the existence condition and the stability of the positive equilibrium are derived. Due to the existence of time delay, the worm propagation system may be unstable and out of control. Moreover, the threshold τ0 of Hopf bifurcation is obtained. The worm propagation system is stable if time delay is less than τ0. When time delay is over τ0, the system will be unstable. In addition, numerical experiments have been performed, which can match the conclusions we deduce. The numerical experiments also show that there exists a threshold in the parameter a, which implies that we should choose appropriate infection rate β(t) to constrain worm prevalence. Finally, simulation experiments are carried out to prove the validity of our conclusions.

Network Intrusion Detection System (NIDS) detection of minority class attacks is always a difficult task when dealing with attacks in complex network environments. To improve the detection capability of minority-class attacks... | Find, read and cite all the research you need on Tech Science Press

The Industrial Control System (ICS) is widely used in industrial processes, such as power grids, water conservancy, natural gas, petrochemical and so on. More and more cyber attacks are targeting the ICS worldwide. This paper presents a novel honeynet-based epidemic model in ICS network. The honeynet is an active approach that can attract malware attacks and provide sample information and immunization strategy of the malware. An epidemic model with immunization and quarantine in ICS network is formulated to explore the dynamics of the malware propagation, and the honeynet potency is analyzed as well. Theoretical analysis reveals the disease-free and endemic equilibrium of our model, then the local and global stability of the disease-free (endemic) equilibrium are examined by the basic reproduction number. Furthermore, numerical experiments show that the honeypot with more system vulnerabilities is conducive to suppress the malware epidemic, and the honeynet with lower average degree power low index can be more effectively. In addition, simulation experiments provide the actual behavior of malware propagation in the ICS network and verification of our derivations.

This study proposes a novel virus propagation model designed explicitly for SCADA(supervisory Control and Data Acquisition) industrial networks. It addresses a critical limitation in existing models applied to the Internet and Industrial Internet of Things (IIoT)—their failure to account for inter-node information exchange processes. The model is inspired by the phenomenon that “immune” nodes in real-world and biological systems inhibit the spread of viruses by exchanging information. This model incorporates isolation strategies to curb virus transmission, considering the uncertainty of vulnerable device behavior. Central to this research are the assumptions of a nonlinear infection rate and dual delays, which better mirror the real-world conditions of industrial control networks. This approach diverges significantly from prior studies that relied on bilinear infection rate assumptions. This study constructed an SMIQR model through theoretical derivation and experimental validation. The model enables nodes to autonomously enhance their defenses after receiving risk information while accounting for the impact of inter-node information exchange. Experiments based on real-world data demonstrated the model’s effectiveness in simulating virus propagation and evaluating defense strategies, overcoming the limitations of traditional bilinear infection rate assumptions. Comparative experiments show that the SMIQR model significantly reduces the number of infected nodes in SCADA industrial networks, demonstrating its superior effectiveness in curbing virus spread. Furthermore, the research proposed dynamic isolation tactics that balance industrial operational continuity, providing SCADA industrial networks with a theoretical framework (incorporating nonlinear infection rates and dual delay characteristics) and practical defense solutions to curb malware spread without disrupting production.