Ensemble Machine Learning for Intrusion Detection in Cyber-Physical Systems

摘要

In this work, we evaluate the benefits of applying ensemble machine learning techniques to CPS attack detection, together with the application of data imbalance techniques. We also compare the performance improvements obtained from bagging, boosting, and stacking ensemble techniques. The stacking models that build upon bagging and boosting provide the best detection performance. After scoring both superior detection performance and low computation cost, the "Stack-2" models provide the best detection efficacy and can easily be deployed to production environment and can be scaled for the protection of hundreds of thousands of network flows per second.