Research on feature selection for cyber attack detection in industrial Internet of Things

With the rapid development of network technology, billions of industrial control systems (ICSs) and the Internet of Things (IoTs) have been equipped with network communication functions. This brings many network security issues while realizing data intercommunication and sharing. In particular, the massive amount of data and the heterogeneous nature of the data have brought huge challenges to the design of an effective intrusion detection system (IDS). In order to clarify the impact of distinct features on anomaly detection, this paper conducts a series of experiments based on the maximum correlation minimum redundancy (MRMR) feature selection algorithm and the support vector machine (SVM) classification method. By comparing the experimental results of UNSW-NB15 data set and MSU data set, traditional data set and industrial data set, it can be seen that different features have different effects on anomaly detection. To be precise, there are both coupling and independence between different features. In particular, industrial data sets based on the Modbus protocol (MSU) have higher redundancy and independence. In other words, we can select more effective data features as attributes of anomaly detection in designing industrial IDS, which can improve the detection accuracy while reducing the detection time.