IMPLEMENTING DEEP PACKET INSPECTION FOR ENHANCED NETWORK SECURITY IN INDUSTRIAL ENVIRONMENTS

Sammanfattning

Industrial energy networks, often operating on resource-limited devices, meet increasing security issues from attacks such as Denial-of-Service, False Data Injection, and spoofing, which can compromise critical functions. A Deep Packet Inspection strategy with lightweight machine learning models was employed to identify abnormalities in IEC 61850 GOOSE communication, a communication protocol for electrical substations. Feature selection was chosen by a Genetic Algorithm that identified the most important packet features. Two deep learning models were designed for efficiency utilizing these features: a Convolutional Neural Network and a sparse neural network created by Differentiable Architecture Search. The models were trained and evaluated using two available datasets for Industrial Control Systems intrusions. The ERENO-IEC-61850 and PowerDuck datasets offer real GOOSE traffic, including various attack scenarios. Additionally, the improved models were implemented on resource-limited embedded hardware to evaluate their performance under actual computational limitations. The results indicate that the suggested DPI-based models may effectively identify abnormalities in GOOSE traffic with minimal computational load, illustrating the potential for improving network security in realistic industrial settings. The results indicate that sophisticated machine learning methodologies may be modified to meet the strict resource limitations built into ICS.