[Paper Review] Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review

Hamza Kheddar, Yassine Himeur+1 more|arXiv (Cornell University)|Apr 19, 2023

Network Security and Intrusion DetectionComputer Science185 references14 citations

TL;DR

This paper surveys how deep transfer learning enhances intrusion detection in industrial control networks, providing taxonomy, datasets, methods, and future directions.

ABSTRACT

Globally, the external internet is increasingly being connected to industrial control systems. As a result, there is an immediate need to protect these networks from a variety of threats. The key infrastructure of industrial activity can be protected from harm using an intrusion detection system (IDS), a preventive mechanism that seeks to recognize new kinds of dangerous threats and hostile activities. This review examines the most recent artificial-intelligence techniques that are used to create IDSs in many kinds of industrial control networks, with a particular emphasis on IDS-based deep transfer learning (DTL). DTL can be seen as a type of information-fusion approach that merges and/or adapts knowledge from multiple domains to enhance the performance of a target task, particularly when labeled data in the target domain is scarce. Publications issued after 2015 were considered. These selected publications were divided into three categories: DTL-only and IDS-only works are examined in the introduction and background section, and DTL-based IDS papers are considered in the core section of this review. By reading this review paper, researchers will be able to gain a better grasp of the current state of DTL approaches used in IDSs in many different types of network. Other useful information, such as the datasets used, the type of DTL employed, the pre-trained network, IDS techniques, the evaluation metrics including accuracy/F-score and false-alarm rate, and the improvements gained, are also covered. The algorithms and methods used in several studies are presented, and the principles of DTL-based IDS subcategories are presented to the reader and illustrated deeply and clearly

Motivation & Objective

• Motivate the use of intrusion detection systems (IDS) for industrial control systems (ICS) security in IoT and beyond-5G contexts.
• Provide a comprehensive taxonomy of deep transfer learning (DTL) models and their IDS applications.
• Survey datasets, pre-trained models, IDS techniques, evaluation metrics, and reported improvements.
• Identify challenges and outline future research directions for DTL-based IDS in ICS/ICN environments.

Proposed method

• Literature selection from major databases (IEEE Xplore, ACM DL, ScienceDirect, SpringerLink) using transfer learning and IDS keywords.
• Three-category framing: DTL-only background, IDS-only background, and DTL-based IDS core studies.
• taxonomy construction for DTL models (inductive, transductive, adversarial) and IDS techniques (signature-, anomaly-, specification-, misuse-, hybrid-based).
• Discussion of datasets used for IDS evaluation in ICS/ICN contexts and associated evaluation metrics (e.g., accuracy, F-score, false alarm rate).
• Synthesis of design decisions, pros/cons, and open challenges to chart future directions.

Figure 1 : Mind map showing the main sections and highlighting the key concepts covered in this review.

Experimental results

Research questions

• RQ1 What is the current state of DTL-based IDS in industrial control networks and ICS security?
• RQ2 How can DTL models be categorized for IDS applications in ICS/ICN environments?
• RQ3 What datasets and evaluation metrics are commonly used to benchmark DTL-based IDS?
• RQ4 What are the main challenges and future directions for IDS-based DTL research in ICS/ICN?
• RQ5 How do DTL approaches compare to traditional IDS methods in terms of adaptability to new threats and data scarcity?

Key findings

• The review consolidates existing DTL applications in IDS for various ICS/ICN scenarios and clarifies their design decisions and limitations.
• It provides a taxonomy of DTL models for IDS, including inductive, transductive, and adversarial DTL.
• It summarizes widely used IDS techniques (signature-, anomaly-, specification-, misuse-, and hybrid-based) and how they integrate with DTL.
• It catalogs datasets used for IDS evaluation in ICS contexts (e.g., SWaT, WADI, ADFA-LD, and others referenced in the paper).
• The paper highlights open challenges and proposes future research directions for advancing IDS-based DTL in ICS/ICN networks.

Figure 2 : Bibliometric analysis in terms of statistics on: (a) Number of articles involved in this review in each year, (b) Top fifteen most cited papers with their authors and publication year, (c) Top fifteen most relevant papers’ sources, (d) Top fifteen most active authors, (e) Percentage of pa