IEEE Consumer Electronics Magazine - January/February 2024 - 35

TABLE 3. Performance of the model proposed for the power-system dataset.
Accuracy
Normal
Function code scan
Illegal setpoint
PID modification
0.99
0.99
1
1
Sensitivity
0.99
0.9
0.99
1
the overall robustness of the classifier remained
consistent throughout the validation phase and
was found to be a notable observation in this study
regardless of the dataset category (binary/tertiary/
multiclass). For instance, the stackednets' accuracy
for the multiclass dataset consistently fluctuates
between 94:63% and 97:60%, thereby indicating
the model's consistency in processing live network
traffic when deployed in a real-time industrial
environment.
Additional observation of this study was that
the oneR and naive bayes classifiers portray highrecall
and low-precision scores, indicating the aforementioned
classifiers are biased toward the TP.
On the other hand, Figures 5 and 6 clearly
depict that the stacked neural-network approach
presented in this article outperformed conventional
methods in detecting cyber-attacks,
thereby validating the generalizable efficiency of
the model proposed.
INTEGRATING THE PRETRAINED
STACKED MODEL WITH AN
OPEN-SOURCE IDS
JARA-a hybrid open-source deploymentready
IDS, which includes both emerging threat
0.99
1
1
Specificity
1
Precision
1
0.83
1
0.98
F-measure
0.99
0.85
0.99
0.99
signatures and the pretrained proposed neuralnetwork
model for knowledge-based and behavior-based
intrusion detection, has been proposed
and developed to break the deployment
barrier of the state-of-the-art intrusion-detection
mechanisms presented in the literature with
respect to industrial control systems. The overall
goal of model-centric JARA was to detect targeted
attacks and identify vulnerable commandand-control
ðC2) channels so that the security
analyst could make better decisions during an
actual threat. To achieve this, JARA incorporates
a modular-framework architecture, where pretrained
behavioral models and detection modules
for a specific industrial network can be remodeled
with newer articulated algorithms that claim
detection supremacy in terms of accuracy and generalizability.
Pretrained model embedded within
the JARA captures network-specific behavior by
inspecting the network packet's duration, size, and
periodicity. Since network behavior differs for
each industrial environment, the detection module
of JARA can be configured to " Train " mode to learn
the networkbehaviorwhendeployedand executed
on an unseen infrastructure. Behavior learning of
an industrial network takes place in two consecuTABLE
4. Performance of the model proposed for the Edge-IIoTset dataset.
N BD HTTP ICMP TCP UDP FA MITM PWD PORT RA SQL UA SCAN XSS
Accuracy 1 0.97 0.94
Sensitivity 1 0.89 0.95
Specificity 1 0.87 0.91
Precision 1 0.96 0.87
F-measure 1 0.92 0.92
0.98
0.96
1
1
0.96 1
0.98 1
1
0.95 1
0.87 1
0.95 1
0.97 0.99
0.92 1
0.89 0.98
0.96 1
0.94 1
0.82 1
0.74
0.75
0.70
0.96
0.97
0.72 1
0.94
0.92 0.91 0.89 0.96
0.89 0.88 0.82 0.89
0.87 0.90 0.85 0.85
0.87 0.86 0.87 0.97
0.84 0.84 0.83 0.95
0.91
0.84
0.89
0.91
0.87
N: normal traffic; BD: backdoor attack; HTTP: HTTP flood DDoS attack; ICMP: ICMP flood DDoS attack; TCP: TCP SYN flood DDoS attack;
UDP: UDP flood DDoS attack; FA: OS fingerprinting attack; MITM: man-in-the-middle attack; PWD: password cracking attack; PORT: port
scanning attack; RA: ransomware attack; SQL: SQL injection attack; UA: upload attack; SCAN: vulnerability scanning attack; XSS: crosssite
scripting attack.
January/February 2024
35
IEEE Consumer Electronics Magazine - January/February 2024

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - January/February 2024
