Intelligent detection of network intrusions into the control infrastructure of autonomous systems based on machine learning methods

Abstract

Window-level machine learning detectors enter the control segments of autonomous systems without a check of how their relative quality depends on the shape of the regular exchange. The calculations establish how detection quality, false confirmations and confirmation delay respond to a two-regime command profile, to mimicry and to different densities of intrusion bursts. The material is a synthetic stream of aggregated command and telemetry windows from a disclosed nine-parameter generator, the modelling unit being a one-second window. Three classifiers were trained and scored on that stream: a Gaussian naive Bayes classifier, L2-regularised logistic regression and an ensemble of decision trees. Estimation covered 1000 episodes of 40 windows, with every parameter recomputed at both ends of its range. At the baseline setting the F1 score spans 0.827 to 0.898, the ensemble sits 0.1 percentage points below the Bayesian classifier, and the shortfall of logistic regression survives every separate substitution of a parameter bound. Thinning the share of intrusion windows to 0.03 pushes the ensemble F1 score to 0.153, while a share of 0.30 raises it to 0.932. Three positive decisions out of five windows leave the false confirmation rate at 0.00%, with 91.6% of bursts caught and a mean confirmation delay of 3.31 windows. Quality in the modelled control segment rests on the fit between the assumptions of a scheme and the shape of the stream, and on the supply of positive examples, rather than on the sophistication of the scheme.