Machine learning methods for identifying attacks on the control system of the industrial Internet of things

Introduction. The article addresses the problem of detecting cyberattacks in the infrastructure of the Industrial Internet of Things (IIoT), the relevance of which is driven by the rapid growth of connected industrial devices and the increasing number of attacks on critical control systems. The aim of the study is to analyze and compare machine learning methods to improve the effectiveness of attack detection in IIoT networks.

Materials and methods. The study is based on a network traffic dataset containing 84 features and 67,267 records. Data preprocessing techniques, informative feature selection, and Principal Component Analysis (PCA) were applied. Several machine learning algorithms were investigated, including Decision Tree, K-Nearest Neighbors, Tree Ensemble, PNN Learner, and Gradient Boosted Trees. Model performance was evaluated using cross-validation and tree depth limitation to mitigate overfitting.

Results and discussion. A comparative analysis of classification models was conducted. The results show that the use of PCA and model parameter optimization significantly improves attack detection accuracy. The best performance was achieved by the Tree Ensemble model, which reached a classification accuracy of 97.5% when using 17 principal components.

Conclusion. The obtained results confirm the effectiveness of machine learning approaches for building intrusion detection and security monitoring systems in Industrial Internet of Things environments.