Skip to Main content Skip to Navigation
Conference papers

Authenticating IDS Autoencoders Using Multipath Neural Networks

Abstract : An Intrusion Detection System (IDS) is a core element for securing critical systems. An IDS can use signatures of known attacks, or an anomaly detection model for detecting unknown attacks. Attacking an IDS is often the entry point of an attack against a critical system. Consequently, the security of IDSs themselves is imperative. To secure model-based IDSs, we propose a method to authenticate the anomaly detection model. The anomaly detection model is an autoencoder for which we only have access to input-output pairs. Inputs consist of time windows of values from sensors and actuators of an Industrial Control System. Our method is based on a multipath Neural Network (NN) classifier, a newly proposed deep learning technique. The idea is to characterize errors of an IDS's autoencoder by using a multipath NN's confidence measure c. We use the Wilcoxon-Mann-Whitney (WMW) test to detect a change in the distribution of the summary variable c, indicating that the autoencoder is not working properly. We compare our method to two baselines. They consist in using other summary variables for the WMW test. We assess the performance of these three methods using simulated data. Among others, our analysis shows that: 1) both baselines are oblivious to some autoencoder spoofing attacks while 2) the WMW test on a multipath NN's confidence measure enables detecting eventually any autoencoder spoofing attack.
Document type :
Conference papers
Complete list of metadata
Contributor : Nathalie Fontaine Connect in order to contact the contributor
Submitted on : Monday, May 30, 2022 - 10:40:29 AM
Last modification on : Tuesday, June 7, 2022 - 11:57:32 AM


Files produced by the author(s)



Raphaël Larsen, Marc-Oliver Pahl, Gouenou Coatrieux. Authenticating IDS Autoencoders Using Multipath Neural Networks. CSNet 2021: 5th Cyber Security in Networking Conference, Oct 2021, Abu Dhabi, United Arab Emirates. ⟨10.1109/CSNet52717.2021.9614279⟩. ⟨hal-03681225⟩



Record views


Files downloads