# Design of Intrusion Detection and Prevention in SCADA System for the Detection of Bias Injection Attacks

Authors: R. B. Benisha; S. Raja Ratna
Journal: Security and Communication Networks
 (2019)

---

## Abstract

Intrusion detection and prevention system detects malicious activities that occur in the real-time SCADA systems. This system has a problem without a profound solution. The challenge of the existing intrusion detection is accuracy in the process of detecting the anomalies. In SCADA, wind turbine data are modified by the intruders and forged details are given to the server. To overcome this, the biased intrusion detection system is used for detecting the intrusion with encrypted date, time, and file location with less false-positive and false-negative rates and thereby preventing the SCADA system from further intrusion. It is done in three phases. First, Modified Grey Wolf Optimization (MGWO) is used to extract the features needed for classification and to find the best weight. Second, Entropy-based Extreme Learning Machine (EELM) is used to extort the features and detect the intruded data with its intruded time, file location, and date. Finally, the data are encrypted using the Hybrid Elliptical Curve Cryptography (HECC) to prevent further attack. Experimental results show better accuracy in both detection as well as prevention.


---

## Body

## 1. Introduction

Supervisory control and data acquisition (SCADA) systems are used for monitoring and controlling numerous industrial and infrastructure processes. In particular, SCADA systems are used in critical infrastructure assets such as chemical plants, electric power generation, transmission and distribution systems, water distribution networks, and wastewater treatment facilities [1].The intrusion detection system (IDS) monitors the events that occur in a system or network and processes them by detecting possible intrusions, whereas the intrusion prevention system (IPS) can crack such possible intrusions [2]. There are two categories of intrusion detection techniques, namely, misuse and anomaly detection [3–6]. Concerning normal system behavior, anomaly detection is mainly related to identifying the events that appear to be malicious. The first approach in the anomaly-based detection problem involves different techniques such as data mining, statistical modeling, and hidden Markov modeling that have been estimated in unusual ways [7]. The second approach for designing intrusion detection systems is misuse-based detection. Attack patterns or signatures are identified and represented in such a way that the system can match these patterns with log files or network traffic [8].The advantage of anomaly-based detection is the ability to find the unknown intrusions. In the case of misuse detection, each instance in the data set is labeled as normal or intrusion. A learning algorithm is applied to label data so that each intrusion is characterized as a model-based intrusion signature [9]. The protection of SCADA systems from cyber attacks is one of the major issues in national and international security [10]. Typically, ID monitors the network traffic to detect any abnormal behavior that indicates malicious activity [11]. The major challenge of applying traditional intrusion detection system (IDS) is that they usually lack sufficient capabilities to investigate network traffic based on unique proprietary protocols found in SCADA systems. This drawback prevents in-depth analysis of network activities, making traditional IDS blind to attacks specific to SCADA systems [12].Rest of the paper is organized as follows. Section2 surveys the associated works regarding the proposed method. In Section 3, a brief discussion about the proposed methodology is presented; Section 4 analysis the investigational outcome and Section 5 will convey the conclusion of this paper.


## 2. Related Work

Finogeev et al. [13] developed the detailed classification of attacks that are present under the selected directions and that detect the intruders in sensor networks of SCADA systems. According to the ZigBee Pro Feature Set specification, the cryptographic encryption tasks in the wireless sensor networks have been determined with the built-in mechanism for encrypting AES with 128 bit keys. The session symmetric key was used to encrypt the sensor data, and asymmetric keys were used to encrypt the session key transmitted from the routing information. This approach has high computational time and this work needs improvement in security.Yousef Farhaoui et al. [14] proposed a novel intrusion detection and intrusion prevention environment for the cloud with three components like trust authority (TA), cloud controller (CC), and Virtual Machine Management (VMM). Initially, packets were collected from cloud users located at different locations. Then, the packet scrutinization (PS) algorithm was used to classify arrival time, flows, confidence levels, and packet counts according to its headers. Then, packets were moved to VMM which classifies the intruder packets and normal packets using the NK-RNN model that has a combination of normalized K-means clustering algorithm with the recurrent neural network.Lin et al. [15] proposed a novel approach for feature optimization and classification of the attack types in the SCADA network. The Linear Weighted Cuckoo Search Optimization (LWCSO) algorithm selects the best features from the overall feature set that corresponds to the name of the attack from the table list. A novel method of Kernel function updates the weighted function of each node and form clusters of optimal feature data. The Probabilistic Kernel Model (PKM) classifier classifies the packet arrived from the particular node as either normal or attack. If the packet flow was detected as a new type of attacker, its label was updated in the library.Muhammet et al. [16] proposed a honey-pot-based approach which is used in the network security for the real-time intrusion detection and prevention system. This methodology consists of three groups, namely, “the honey-pot server application,” “the monitor application,” and “the IDS application.” This system was a honey-pot-based intrusion detection and prevention system (IDPS) type, and it was able to show the network traffic on servers visually in real-time animation. This approach reduces the cost of information security in an enterprise network.Leandros et al. [17] presented an integrated one-class support vector machine (OCSVM) mechanism for detecting the origin of attacks that are distributed in the SCADA network. Network traffic and spilled traffic are identified by the source of OCSVM models. These trained models run in parallel and fastly recognize different types of attacks. This approach needs more enhancements.Wei et al. [18] proposed a model for detecting the attacks in the wireless mobile network. The major objective of this paper is to improve the time reduction without affecting the effectiveness of the systems. In this paper, abnormal behavior of the nodes is detected by remotely monitoring the security level. The major contribution of the work is to increase the lifetime, and the energy consumed was detected.Zhang et al. [19] proposed a new detection-based Dirichlet scheme which detects the unwanted attacks in the control systems from the data that are being taken from the CPS. The requirements are being satisfied by the hierarchical framework control. Leckie et al. [20] developed a new model system of the least square vector supporting a machine-based detection system for the detection of the attacks in the computer network. Here, a common-based information algorithm was introduced for extracting the optimized feature for the classification. Here, detection-based data sets including cup KDD 99, NSL and KDD, and Kyoto are proposed.Khaltar et al. [21] proposed a system-placed scheme trusty for the internal and external traffic monitoring. Here, operational and capital expenditures were decreased for the number of turbines by selecting the systems that are equipped trustfully. McLaughlin et al. proposed a framework for the multiple layers which protect from the intrusions that are caused in the SCADA. In this paper, accurate problem detection was detected for the mitigation of intruders. Furthermore, the Whitelist intrusion detection system and the protocol behavior for detecting the normal and the abnormal attacks are discussed. The main strength of this paper is security in delivering the power, reliability, and stability.Kayssi et al. [22] proposed a three-layer system of detection for the protection of the control systems. The major contribution of this paper is to protect the control network by separating the MST problem. The routing technique used in the edge was used to gather the IOT service data. The abovementioned trust scheme was introduced in many industrial secure control systems. Saniyal et al. [23] proposed a new specific SCADA intrusion detection scheme which detects the traffic and frequency patterns of attacks. The requirements of this paper are listed below: repository data sniffer, extracting the attributes, different phase structure learning, threshold measuring, and detecting phase. Hence, the correlated time that is happened across the layers is detected for finding the normal and abnormal data.Atkison et al. [24] proposed a new technique for detecting the problems that are considered by the detection of intruders, and hence the attacks are separated for water supply. The objective of this paper is to detect the intruders and provide a solution for the problem accurately and to separate the intruders by blocking it. Sensor measurements are taken from a period of time. Jiang et al. introduced a new scheme of One-class vector supporting machine which detects the hackers in the industrial control systems. A schematic algorithm is proposed for the performance improvement, and also the K-means clustering-based algorithm is used which separates the attacks in three phases: easy, medium, and highly severe. The drawback of this paper is to reduce the false alarms for the phases.Litler et al. [25] developed a new intrusion detection system which is rule-based that detects the unwanted changes that are occurring in the industrial control systems. The objective of this paper is used to detect the knowledge-based and signature-based attacks that are occurred in the SCADA. The advantage is to detect all the unwanted malicious nodes occurring suspiciously. Sezer et al. [26] proposed separate strategic rules which include the approaches that are rule-based, Markov Model that are hidden, and vector supporting machines for detecting the intruders. Both good and malicious activities are being discussed here. It is analyzed and performed that the International level of security should be given for cyber attack detection.Jiang et al. [27] performed a static relation detection of intrusion which detects all the negative data that are occurred in the SCADA network. The requirements that are contributed in this paper are given below: the static system is monitored, inconsistent state is detected, and origins that are compared are inferred. Wool et al. [28] proposed a new model scheme which is based on the monitoring of key instructions that are occurred in the SCADA systems. The aim of this paper is abnormal activities are sensitively separated by the Modbus system.Tari et al. [29] developed a new anomaly-based unsupervised detection system which detects the deception attacks that are occurred in the Industrial control systems. The paper aims to detect the consistencies of the SCADA systems, and the rule-based schemes are being extracted from the states that are identified. Here, abnormal observations from the normal behavior are isolated by using inconsistency threshold optimization. Naser et al. [30] proposed a new detection technique that classifies the statistically based attacks. The data set that is taken from the real wind data for the detection of intrusions and its research work is also discussed.To solve the above state-of-method problems, this paper designed a novel model for intrusion detection and prevention system. This system is to remove redundant data that are present in the database, and then extract the relevant features that are necessary for classification. Ingress traffic and egress traffic are separated and the data that are presented as abnormal are identified clearly with time, date, and file location. The normal data are sent in an encrypted manner to prevent the data from being attacked.


## 3. Problem Detection and Assumptions

### 3.1. Problem Statement

ConsiderN number of nodes communicating between the source S and the destination D through the SCADA wireless network. Intruder IM is present in between the source and the destination to capture the reliable data needed for the growth of the production. It injects traffic delay and changes or modifies the data which affect the organizational growth. The intruder IM changes the information slightly so that no one can easily find out the changes made in the data by the intruder, but due to the small variations in the data, economy is highly affected. The main motto of this paper is to detect the encrypted date, time, and file location of the biased intruder with less false-negative rates and to prevent the information by Cryptographic hashing technique by selecting a trusted routing path for encryption. Also, sudden frequency specification changes in the SCADA system are identified. The variables and parameters used are discrete with binary value of 0 and 1.


### 3.2. Network Link

Network link containsN number of sources in which all the information is passed through this link. The communication range can be of single hop or multi-hop or through direct communication. In SCADA, particular scenario is created where the nodes within the range send information continuously through the wireless network link.


### 3.3. Interloper Model

The intruderIM is placed in the wireless network in which they eavesdrop in corrupting the data and making changes to the system. It captures any kind of data between the source and the destination that are superior to nodes. In full duplex mode, the information is transmitted and received. In this paper biased intruder is placed in the wireless network in which they know all the secrets and resides. The drawbacks caused due to the biased intruder are as follows: (1) smart decision and efficient energy in modifying the information with less power, (2) detecting the biased intruder is an exigent task because they lower the coverage risk, and (3) since the information is slightly modified, the performance of the network is not deeply affected.


### 3.4. Overview of Biased Intrusion Scheme

The proposed Biased Intrusion scheme contains three modules: (a) Modified Grey Wolf Optimization, (b) Entropy-based Extreme Learning Machine (EELM), and (c) Hybrid Elliptical curve cryptography (HECC) techniques. The system outline of this biased intrusion is described below:(i)
In the MGWO technique, real-time SCADA is analyzed with the directory trust files, and the trusted features are extracted for all the functions using the trusted table. The malicious functions are sorted and updated.(ii)
In the EELM technique, the biased injected intruders are detected and separated with encrypted time, date, and file location. The detected intruder is stored in the directory trust file.(iii)
In the HECC technique, the normal data are encrypted using MD5 cryptographic hashing technique, and the information is secured by choosing the trusted routing path.


## 3.1. Problem Statement

ConsiderN number of nodes communicating between the source S and the destination D through the SCADA wireless network. Intruder IM is present in between the source and the destination to capture the reliable data needed for the growth of the production. It injects traffic delay and changes or modifies the data which affect the organizational growth. The intruder IM changes the information slightly so that no one can easily find out the changes made in the data by the intruder, but due to the small variations in the data, economy is highly affected. The main motto of this paper is to detect the encrypted date, time, and file location of the biased intruder with less false-negative rates and to prevent the information by Cryptographic hashing technique by selecting a trusted routing path for encryption. Also, sudden frequency specification changes in the SCADA system are identified. The variables and parameters used are discrete with binary value of 0 and 1.


## 3.2. Network Link

Network link containsN number of sources in which all the information is passed through this link. The communication range can be of single hop or multi-hop or through direct communication. In SCADA, particular scenario is created where the nodes within the range send information continuously through the wireless network link.


## 3.3. Interloper Model

The intruderIM is placed in the wireless network in which they eavesdrop in corrupting the data and making changes to the system. It captures any kind of data between the source and the destination that are superior to nodes. In full duplex mode, the information is transmitted and received. In this paper biased intruder is placed in the wireless network in which they know all the secrets and resides. The drawbacks caused due to the biased intruder are as follows: (1) smart decision and efficient energy in modifying the information with less power, (2) detecting the biased intruder is an exigent task because they lower the coverage risk, and (3) since the information is slightly modified, the performance of the network is not deeply affected.


## 3.4. Overview of Biased Intrusion Scheme

The proposed Biased Intrusion scheme contains three modules: (a) Modified Grey Wolf Optimization, (b) Entropy-based Extreme Learning Machine (EELM), and (c) Hybrid Elliptical curve cryptography (HECC) techniques. The system outline of this biased intrusion is described below:(i)
In the MGWO technique, real-time SCADA is analyzed with the directory trust files, and the trusted features are extracted for all the functions using the trusted table. The malicious functions are sorted and updated.(ii)
In the EELM technique, the biased injected intruders are detected and separated with encrypted time, date, and file location. The detected intruder is stored in the directory trust file.(iii)
In the HECC technique, the normal data are encrypted using MD5 cryptographic hashing technique, and the information is secured by choosing the trusted routing path.


## 4. Biased Intrusion Detection System (BIDS)

### 4.1. Initialization Process

In the biased intrusion detection system, modified information is easily detected and extracted. It deals with the detection of intrusion in a SCADA systemn and prevents user’s v from intruders. The steps involved in the BIDS are enlisted as follows: initially, the real-time data set from SCADA wind turbines ∏ir=1,2,…,tk is taken for detection. The database contains ki∗fji∈1,N,k∈1,0 number of records corresponding to normal as well as the attacked situations. k represents normal data, f represents intruded data, and N represents the number of features. The intruded data is nothing but attacked data that had occurred previously in the SCADA network. A directory trust file is maintained in the SCADA, which contains past records of effectively captured attacks between the source and destination. The real-time data αar,u are compared with the data present in the directory trust file ∂Ni,m. If αar,u=∂Ni,m, attack is present in the data set, and therefore it has to be blocked to avoid damage from a further transactions. If αar,u≠∂Ni,m, attack is not occurred and the following steps are carried out. The presence of redundant information dx,y may lead to false results. A redundant information removal scheme is carried out using the calculation of variance λv. The directory trust file ∂Ni,m contains malicious n×m recorded events that occurred in the system during software runs or communication between different users Ui,r. Here, ∂Ni,m trust file is considered for maintaining the attacked data in the SCADA wind turbines.


### 4.2. Redundant Information Removal (RIR) Using Normalization

Redundant Information Removal (RIR) phase is to reduce data∏ir as much as possible without any information loss, and it requires specialized planning, training, and testing. This phase provides an optimal and efficient computing data U for IDS, filter false rates, remove detection rates, and to discover attack patterns and display appropriate data types for administrators to make policies. The Normalization technique is used for the RIR phase. The data that are attributed from the SCADA are scaled to fit into a specific range [0, 1], where ξ=0 and Ω=1. Min-Max normalization is used here to improve better prediction value. The size Sr,q of each feature is initialized. Min-Max normalization transforms a value Γρr which fits in the range [0, 1]:(1)VNR=Γρr−ΓρminrΓρmaxr−Γρmaxr∗Ω−ξ+ξ,where VNR denotes the normalization and 0 and 1 denotes the range. The normalized value represents Γρminr and Γρmaxr which are subtracted and multiplied with ξ.


### 4.3. Feature Extraction

The features extractedLα,p from the resources are required to represent a particular data set. The set of windmill data Hx,t are extracted from the data set and it is mathematically expressed as(2)Hx,t=f11f12..f1mf21f22..f2m..........fn1fn2..fnm,Fi=F1,F2,F3,…,FN,where N represents the number of features and Fi denotes the feature set. When the SCADA data Rr≥k, where k represents the original data and it is suspected to be redundant, then it can be transferred into redundant features x×t. Determining a subset of the initial features Hx,t, the redundant information dx,y is determined as the initial features. Instead of using complete data Hx,t and dx,y the selected features f11,f51,f61,…,fm1 are used from the input data ∏ir so that the desired task can be performed. The steps involved in selecting the features are processed by n×m matrix, and the sort out feature is taken for optimization.FeaturefKN is selected for optimization. Feature selection and feature extraction are done using the Modified Grey Wolf Optimization (MGWO) algorithm. The feature set is taken as fKN=N∈iN:y, where N represents 1×79 matrix and target Tar is given to select the features needed for optimization. Figure 1 shows the proposed system architecture.Figure 1
Block diagram for the proposed system.


## 4.1. Initialization Process

In the biased intrusion detection system, modified information is easily detected and extracted. It deals with the detection of intrusion in a SCADA systemn and prevents user’s v from intruders. The steps involved in the BIDS are enlisted as follows: initially, the real-time data set from SCADA wind turbines ∏ir=1,2,…,tk is taken for detection. The database contains ki∗fji∈1,N,k∈1,0 number of records corresponding to normal as well as the attacked situations. k represents normal data, f represents intruded data, and N represents the number of features. The intruded data is nothing but attacked data that had occurred previously in the SCADA network. A directory trust file is maintained in the SCADA, which contains past records of effectively captured attacks between the source and destination. The real-time data αar,u are compared with the data present in the directory trust file ∂Ni,m. If αar,u=∂Ni,m, attack is present in the data set, and therefore it has to be blocked to avoid damage from a further transactions. If αar,u≠∂Ni,m, attack is not occurred and the following steps are carried out. The presence of redundant information dx,y may lead to false results. A redundant information removal scheme is carried out using the calculation of variance λv. The directory trust file ∂Ni,m contains malicious n×m recorded events that occurred in the system during software runs or communication between different users Ui,r. Here, ∂Ni,m trust file is considered for maintaining the attacked data in the SCADA wind turbines.


## 4.2. Redundant Information Removal (RIR) Using Normalization

Redundant Information Removal (RIR) phase is to reduce data∏ir as much as possible without any information loss, and it requires specialized planning, training, and testing. This phase provides an optimal and efficient computing data U for IDS, filter false rates, remove detection rates, and to discover attack patterns and display appropriate data types for administrators to make policies. The Normalization technique is used for the RIR phase. The data that are attributed from the SCADA are scaled to fit into a specific range [0, 1], where ξ=0 and Ω=1. Min-Max normalization is used here to improve better prediction value. The size Sr,q of each feature is initialized. Min-Max normalization transforms a value Γρr which fits in the range [0, 1]:(1)VNR=Γρr−ΓρminrΓρmaxr−Γρmaxr∗Ω−ξ+ξ,where VNR denotes the normalization and 0 and 1 denotes the range. The normalized value represents Γρminr and Γρmaxr which are subtracted and multiplied with ξ.


## 4.3. Feature Extraction

The features extractedLα,p from the resources are required to represent a particular data set. The set of windmill data Hx,t are extracted from the data set and it is mathematically expressed as(2)Hx,t=f11f12..f1mf21f22..f2m..........fn1fn2..fnm,Fi=F1,F2,F3,…,FN,where N represents the number of features and Fi denotes the feature set. When the SCADA data Rr≥k, where k represents the original data and it is suspected to be redundant, then it can be transferred into redundant features x×t. Determining a subset of the initial features Hx,t, the redundant information dx,y is determined as the initial features. Instead of using complete data Hx,t and dx,y the selected features f11,f51,f61,…,fm1 are used from the input data ∏ir so that the desired task can be performed. The steps involved in selecting the features are processed by n×m matrix, and the sort out feature is taken for optimization.FeaturefKN is selected for optimization. Feature selection and feature extraction are done using the Modified Grey Wolf Optimization (MGWO) algorithm. The feature set is taken as fKN=N∈iN:y, where N represents 1×79 matrix and target Tar is given to select the features needed for optimization. Figure 1 shows the proposed system architecture.Figure 1
Block diagram for the proposed system.


## 5. Modified Grey Wolf Optimization (MGWO)

The MGWO algorithm simulates the grey wolf behavior to live and hunt together in a pack. The steps involved in the living and hunting process are as follows: (a) a prey is chased and encircled when it is found. (b) When the prey escapes, it pursues the prey till it stops moving. (c) The prey is attacked finally. This algorithm is used to produce the best optimized output with small errors, while the previous algorithms would direct failure at many instances. Compared with the other algorithms, the MGWO algorithm has smaller amount of parameters with improving feasibility by establishing maximum iterations.The trained dataμx are taken to find the best weight. Trained data μx can be represented as μxfKN,Tar. The length of the data depends on the size of μx, and the iteration values are maximized to 100. Three levels are initialized for maximization problems. The top level is the leaders denoted as γαρ, called alpha. The alpha is responsible for making decisions in the pack. The persistence of the wolf pack is based on the alpha’s decision. The second level is the subordinate wolves denoted as Ωru, called beta. The operation of the subordinate beta is to help the alpha γαρ in decision making or other activities. The third level is the lower subordinate wolves denoted as ∂lx, called delta. The members in this category consist of scouts, sentinels, elders, hunters, and caretakers. The lowest level is baby sitters denoted as ωh, called omega. The omega wolves have to comply with all the other dominant wolves such as γαρ, Ωru, and ∂lx. To simulate the hunting behavior of the grey wolves to the mathematical model, the best solution is assumed to be γαρ,Ωru,∂lx≡Ωru,∂lx, where the three levels are similar to the second and third optimal solutions, respectively. Three levels are assigned for the input features fNK, where N = (0, 1, 2, …, n) and the best features are selected for obtaining the best classified output. The fundamental principle of MGWO is to implement the variation among individuals to recombine and obtain intermediate individuals, and competition between parent and offspring is obtained through the next generation. The main segments of MGWO are encircling process, crossover Mutation, categorization, and updating.


### 5.1. Encircling Process

In the encircling strategy, the data valuesξ are randomly taken from fKN by the wolves around the prey, and it is mathematically modeled as Di→; position of the prey is denoted as γ→fit at tth iteration; position of the wolf is denoted as γ→ft; γ→ft+1 is the position of the wolf at (t + 1)th iteration; D→i is the difference vector; KLrn and KGidare the notation, and a→ is a linearly decreasing vector from 2 to 0 over iteration. The steps involved in this process are given below:(i)
The difference vectorD→i is sustained to find the position of the prey γ→fit and position of the wolf γ→ft:(3)D→i=KGid⋅γ→fit−γ→ft.(ii)
Fort+1 iterations, γ→ft+1 depends on the position of prey, and the difference vector D→i for t iterations is loaded:(4)γft+1=γ→fit−KLrn−D→i.(iii)
The coefficient vectorsKLrn and KGid are the random values which decrease linearly from 2 to 0, and they determine a→:(5)KLrn=2a→rand1−a→,KGid=2rand2,(6)a→=2−2t÷maxIvm,where rand1andrand2 are uniformly distributed random vectors whose component lies between 0 and 1 and Ivm is the maximum number of iterations.


### 5.2. Sorting and Updating

Identify the best hunt agentλγαρ, the second hunt agent λΩru, and the third hunt agent λ∂lx using sorting and updating. It is applied to make the optimization more effective. For n parents choose n − 1 displacement points and select the genes between these points. For the iteration, i = 1 size and the position is upgraded. The fitness θir is repeatedly calculated for different iterations. If θir+1=θir of t+1th iteration, updating process takes place for γαρ, Ωru, and ∂lx.(i)
Ifθir>γαρ, then γαρ=θir; γαρ value is updated and γαρ position is replaced to the iteration position.(ii)
Ifθir>γαρ and θir>Ωru, then Ωru=θir and Ωru value is updated. The Ωru position is replaced to the iterated position.(iii)
Ifθir>γαρ, θir>Ωru, and θir>∂lx, then ∂lx=θir and ∂lx value is updated and replaced to ith position.Sorting is descending all the iteration values fromi = 1,2, …, 100. If the iteration value i = 0 is chosen the best, then the fitness value θir is estimated as best for the 0th iteration. If the i = 1 sorted value is greater than the 0th iteration, then the maximum value is sorted and updated as the best weight.


### 5.3. Crossover Mutation

In crossover mutation, the values are changed randomly for the next generation and the greater value is updated as fitness. The step continues for each updation and as a result, the best weight is saved. Crossover mutation is carried out in the process to make it more effective. From changing the values randomly better input weight is estimated.The hunting strategy of the grey wolves can be mathematically modeled by approximating the prey position with the help ofγαρ,Ωru, and ∂lx solutions. After performing crossover, the mutation operator is applied to the solutions. This operator selects a gene from a wolf randomly and changes its content. This is carried out by the crossover points as shown in Table 1.Table 1
Crossover mutation model.
Position H[t]
Π
ψ
Ω
x
Γ
ρ
ξ
ν
μ
x
γ
r
ω
i
τ
i
β
t
I[t]
Π
d
Γ
x
ξ
u
Ω
y
θ
r
Γ
r
∂
l
y
φ
x
δ
m
R[t]
k
1
k
2
k
3
k
4
k
5
k
6
k
7
k
8
k
9
N[t]
Π
Ψ
Ω
x
Γ
ρ
Γ
r
∂
l
y
k
8
k
9
L[t]
k
1
k
2
k
3
ξ
ν
μ
x
γ
r
ω
i
Ψ
x
δ
m
S[t]
ξ
u
k
4
k
5
k
6
ω
i
τ
i
β
t
H[t] denotes the current position; I[t] denotes the best personal experience; R[t] indicates the best global position among all wolves; N[t] indicates the offspring 1; L[t] denotes offspring 2; and S[t] indicates offspring 3. After mutation, the location of the current hunt agent is renewed.A and D are the coefficient vectors for linearly decreasing iterations.(7)
F
→
1
+
F
→
2
+
F
→
3
=
γ
α
ρ
−
A
→
γ
α
ρ
⋅
D
→
γ
α
ρ
+
Ω
r
u
−
A
→
Ω
r
u
⋅
D
→
Ω
r
u
+
∂
l
x
−
A
→
∂
l
x
⋅
D
→
∂
l
x
,
(8)
F
→
t
+
1
=
∑
n
=
1
3
F
n
/
3
.The fitness values of all the huntsF1, F2, and F3 wolves are estimated and updated. It is obvious that when the prey stops moving, the wolf kills the prey, and in this way they complete their hunting process by repeating encircling, sorting, updating, crossover, and mutation. Algorithm 1 shows the pseudo code of the proposed MGWO.Algorithm 1:Pseudo code of proposed Modified Grey Wolf Optimization.
IndexN number of features
F
N = (F1, F2, …, FN)
Step 1: Initialize ‘n’ population size
F
→
t
=
t
=
1,2
,
…
,
n
,
factor
A
→
,
C
→
Sett = 0; //preliminary value
r = 1; //radius initialized
Step 2: Approximate cost functional value asCov
C
ov
=
H
1
,
d
×
l
Where,d=1+r×∑fKN/M−1×∑fi
Step 3: seti = 1
While (i ≤ n) do
F
→
t
=
1; //Random generation
F
→
t
+
1
=
F
→
P
t
−
A
→
⋅
D
→
Step 4: Selectγαρ=0;Ωru=0;∂lx=0
Step 5: Updating phase
while
t
<
Max
x
r
;
F
→
=
F
→
1
+
F
→
2
+
F
→
3
/
3
;//
Position is updated
r
1
=
m
1
+
n
o
×
d
2
+
d
1
/
r
+
S
1; update radius
m
1
=
Min
x
r
C
o
v
±
S
×
Max
x
r
−
Min
x
r
−
I
V
m
Step 6: fori = 1 to N; //Iterations undertaken
i
f
θ
i
r
<
θ
i
r
t
+
1
N
=
1
,
if
l
+
e
r
<
0
,
0
,
else
.
Step 7:Xsorti=xi−1+2a→rand1−a→∗mi
y
sort
i
=
y
i
−
1
+
2
a
→
rand
1
−
a
→
∗
m
i
if
θ
i
r
<
H
m; //cross over mutation
Where;Hm=2−s+d/s−d1/u
R
mut
=
x
i
−
1
+
H
m
×
Max
x
r
−
Min
x
r
S
mut
=
y
i
−
1
+
H
m
×
Max
x
r
−
Min
x
r
Update weight of selected features
End


## 5.1. Encircling Process

In the encircling strategy, the data valuesξ are randomly taken from fKN by the wolves around the prey, and it is mathematically modeled as Di→; position of the prey is denoted as γ→fit at tth iteration; position of the wolf is denoted as γ→ft; γ→ft+1 is the position of the wolf at (t + 1)th iteration; D→i is the difference vector; KLrn and KGidare the notation, and a→ is a linearly decreasing vector from 2 to 0 over iteration. The steps involved in this process are given below:(i)
The difference vectorD→i is sustained to find the position of the prey γ→fit and position of the wolf γ→ft:(3)D→i=KGid⋅γ→fit−γ→ft.(ii)
Fort+1 iterations, γ→ft+1 depends on the position of prey, and the difference vector D→i for t iterations is loaded:(4)γft+1=γ→fit−KLrn−D→i.(iii)
The coefficient vectorsKLrn and KGid are the random values which decrease linearly from 2 to 0, and they determine a→:(5)KLrn=2a→rand1−a→,KGid=2rand2,(6)a→=2−2t÷maxIvm,where rand1andrand2 are uniformly distributed random vectors whose component lies between 0 and 1 and Ivm is the maximum number of iterations.


## 5.2. Sorting and Updating

Identify the best hunt agentλγαρ, the second hunt agent λΩru, and the third hunt agent λ∂lx using sorting and updating. It is applied to make the optimization more effective. For n parents choose n − 1 displacement points and select the genes between these points. For the iteration, i = 1 size and the position is upgraded. The fitness θir is repeatedly calculated for different iterations. If θir+1=θir of t+1th iteration, updating process takes place for γαρ, Ωru, and ∂lx.(i)
Ifθir>γαρ, then γαρ=θir; γαρ value is updated and γαρ position is replaced to the iteration position.(ii)
Ifθir>γαρ and θir>Ωru, then Ωru=θir and Ωru value is updated. The Ωru position is replaced to the iterated position.(iii)
Ifθir>γαρ, θir>Ωru, and θir>∂lx, then ∂lx=θir and ∂lx value is updated and replaced to ith position.Sorting is descending all the iteration values fromi = 1,2, …, 100. If the iteration value i = 0 is chosen the best, then the fitness value θir is estimated as best for the 0th iteration. If the i = 1 sorted value is greater than the 0th iteration, then the maximum value is sorted and updated as the best weight.


## 5.3. Crossover Mutation

In crossover mutation, the values are changed randomly for the next generation and the greater value is updated as fitness. The step continues for each updation and as a result, the best weight is saved. Crossover mutation is carried out in the process to make it more effective. From changing the values randomly better input weight is estimated.The hunting strategy of the grey wolves can be mathematically modeled by approximating the prey position with the help ofγαρ,Ωru, and ∂lx solutions. After performing crossover, the mutation operator is applied to the solutions. This operator selects a gene from a wolf randomly and changes its content. This is carried out by the crossover points as shown in Table 1.Table 1
Crossover mutation model.
Position H[t]
Π
ψ
Ω
x
Γ
ρ
ξ
ν
μ
x
γ
r
ω
i
τ
i
β
t
I[t]
Π
d
Γ
x
ξ
u
Ω
y
θ
r
Γ
r
∂
l
y
φ
x
δ
m
R[t]
k
1
k
2
k
3
k
4
k
5
k
6
k
7
k
8
k
9
N[t]
Π
Ψ
Ω
x
Γ
ρ
Γ
r
∂
l
y
k
8
k
9
L[t]
k
1
k
2
k
3
ξ
ν
μ
x
γ
r
ω
i
Ψ
x
δ
m
S[t]
ξ
u
k
4
k
5
k
6
ω
i
τ
i
β
t
H[t] denotes the current position; I[t] denotes the best personal experience; R[t] indicates the best global position among all wolves; N[t] indicates the offspring 1; L[t] denotes offspring 2; and S[t] indicates offspring 3. After mutation, the location of the current hunt agent is renewed.A and D are the coefficient vectors for linearly decreasing iterations.(7)
F
→
1
+
F
→
2
+
F
→
3
=
γ
α
ρ
−
A
→
γ
α
ρ
⋅
D
→
γ
α
ρ
+
Ω
r
u
−
A
→
Ω
r
u
⋅
D
→
Ω
r
u
+
∂
l
x
−
A
→
∂
l
x
⋅
D
→
∂
l
x
,
(8)
F
→
t
+
1
=
∑
n
=
1
3
F
n
/
3
.The fitness values of all the huntsF1, F2, and F3 wolves are estimated and updated. It is obvious that when the prey stops moving, the wolf kills the prey, and in this way they complete their hunting process by repeating encircling, sorting, updating, crossover, and mutation. Algorithm 1 shows the pseudo code of the proposed MGWO.Algorithm 1:Pseudo code of proposed Modified Grey Wolf Optimization.
IndexN number of features
F
N = (F1, F2, …, FN)
Step 1: Initialize ‘n’ population size
F
→
t
=
t
=
1,2
,
…
,
n
,
factor
A
→
,
C
→
Sett = 0; //preliminary value
r = 1; //radius initialized
Step 2: Approximate cost functional value asCov
C
ov
=
H
1
,
d
×
l
Where,d=1+r×∑fKN/M−1×∑fi
Step 3: seti = 1
While (i ≤ n) do
F
→
t
=
1; //Random generation
F
→
t
+
1
=
F
→
P
t
−
A
→
⋅
D
→
Step 4: Selectγαρ=0;Ωru=0;∂lx=0
Step 5: Updating phase
while
t
<
Max
x
r
;
F
→
=
F
→
1
+
F
→
2
+
F
→
3
/
3
;//
Position is updated
r
1
=
m
1
+
n
o
×
d
2
+
d
1
/
r
+
S
1; update radius
m
1
=
Min
x
r
C
o
v
±
S
×
Max
x
r
−
Min
x
r
−
I
V
m
Step 6: fori = 1 to N; //Iterations undertaken
i
f
θ
i
r
<
θ
i
r
t
+
1
N
=
1
,
if
l
+
e
r
<
0
,
0
,
else
.
Step 7:Xsorti=xi−1+2a→rand1−a→∗mi
y
sort
i
=
y
i
−
1
+
2
a
→
rand
1
−
a
→
∗
m
i
if
θ
i
r
<
H
m; //cross over mutation
Where;Hm=2−s+d/s−d1/u
R
mut
=
x
i
−
1
+
H
m
×
Max
x
r
−
Min
x
r
S
mut
=
y
i
−
1
+
H
m
×
Max
x
r
−
Min
x
r
Update weight of selected features
End


## 6. Entropy-Based Extreme Learning Machine (EELM)

The classification intends to discover whether the regarded windmill data are normal data or attacked data. Here, the classification technique is performed by utilizing the Entropy-based ELM. In SCADA wind turbines, data transmitted from one source to another destination gets modified by the intruders; such types of intruders are detected and prevented by this classification technique. The normal data can be encrypted and the intruded data can be stored in the directory trust file to avoid such kinds of attacks from further intrusion. The best weight of the optimized output is given as an input to the classifier for intrusion detection and prevention. The features that are attained from the preceding processes of this system are classified centering on their characteristics into 2 separate classes such as (i) normal data and (ii) attacked data of the intrusion detection and prevention system. The Entropy-based ELM for classification pseudo code of this proposed method is shown in Algorithm2.Algorithm 2:Pseudo code for proposed the Entropy-based Extreme Learning Machine.
Step 1: Initialize training setxi,tii=1L
Activation functionf(x); hidden node number L
W
j = 0; j = 1, 2, …, L; Wj random generation of hidden mode
Step 2: Calculate Entropy
b
j
=
−
∑
j
=
1
W
j
log
2
W
j; //bias value generation
Step 3:Zry=RandWhi;Zly=RandWr
Where;Whi=ehid1+ehid2/ehid1−ehid2
Whi=ehid1−ehid2/ehid1+ehid2
Step 4: Calculate
H = (W1, W2, …, WL); (x1, x2, …, xN); (b1, b2, …, bL)
β = HT T; //output matrix determined
Step 5: Calculate actual outputSj
∑
j
=
1
β
j
f
W
j
x
i
+
b
j
=
S
j
;
1
≤
i
≤
n
Step 6:γ = γ + D; //Direction of the features
ξ
=
ξ
∗
γ
+
D
Step 7: ifx > Minxr(γ); //feature verified
EM = Rb(i); //Label function condition
EndELM is formulated as a linear-in-the-parameter model which boils down by solving a linear system. Compared to traditional Feedforward Neural Network (FNN) learning methods, the ELM is remarkably efficient and tends to reach a global optimum. The ELM is briefly described as follows.Extreme Learning Machines use a set of “N” distinct samples xi,ti, where xi∈Rm and ti∈Rn. A standard function with L hidden neurons and activation function fx is mathematically modeled in the Entropy-based classifier by(9)∑j=1Lβjfwjxi+bj=sj,1≤i≤n,where wj represents the input data weights, bj denotes the biases, xi is the input data, βj denotes the output weight, and sj refers the actual output. The bias values are randomly generated based on the input weight entropy, which are expressed as(10)bj=−∑j=1nwjlog2wj.


### 6.1. Moore–Penrose Model

The ELM approach is to initialize randomlywj and bj and compute the output weights β=HTT by a Moore–Penrose pseudo inverse. The learned parameters wi, b, H, β, f, and L are used as models to classify the test data set in the intrusion detection system. T denotes the target value, which has attacked data and normal data. ELMs are used to resolve the learning problems of type as given below:(11)Hβ=T,where(12)H=fw1⋅x1+b1⋯fwL⋅x1+bL.⋯.fw1⋅xn+b1⋯fwL⋅xn+bL,β=β1T..βLTT,T=t1T..tLTT.Biased Injection attacks are detected and classified, which detects the proper time, file location, and date of the intrusion. During the classification process, the attacked data are sent to the directory trust file and the system identifies the particular features on which the attack has been carried out. For example, if the speed is high and the obtained power is less, then there is a chance of attack to occur. Then, the normal data are encrypted using Hybrid Elliptic Curve Cryptography (HECC), and the encryption is delineated in the below section.


### 6.2. Encryption Using Hybrid ECC

Security is needed to transfer the information from one source to another destination. The windmill data must be sent in a secure manner to the receiver in this proposed intrusion detection and prevention system. To ensure privacy in transferring the data, the Hybrid Elliptic Curve Cryptography (HECC) is used. The system accepts the input file and it is applied for the ECC encryption process, and then the MD5 algorithm is applied to generate a 64 bit key. On the decryption side, it will get a cipher text and 64 bit key. The collision in the MD5 algorithm can be identified and separated by the Flame Malware. ECC decryption process is applied to the cipher text, and the original message is obtained. If the received 64 bit key and generated 64 bit key are the same, then the message will accept it; otherwise, the message will get discard.The ECC algorithm is a type of mechanism that is adopted in the implementation of public key cryptography. This technique is based on a curve with specific base points and the use of a prime number function. This function is used as a maximum limit. The mathematical representation of the ECC is shown here:(13)y2=x3+ax+b,where a and b are the numerals. In a cryptographic process, the strength of the encryption technique depends purely on the mechanism that is employed for the generation of the key.


### 6.3. Cryptographic Hashing

In the Cryptographic hashing, there are two types of keys that have to be generated. The first step is to generate the public key from the server to encrypt the message. The second step is to generate a private key on the server side to decrypt the message. A pointB is selected as a base point on the curve. Secret key Sk is generated with the multiplication of a private key, a public key, and a base point. A random number KTA and the public key PTA is selected and generated as follows:(14)PTA=KTA∗B.After the generation of the key, the values are encrypted. The encrypted information contains two cipher texts that are mathematically represented as follows:(15)C1+C2=S1∗B+M+S1∗PTA,(16)M=C2−KTA∗C1+Sk.In equation (15) the cipher texts C1 and C2 are generated. C1 and C2 are sent with MD5 that is generated by the 64 bit key. The proposed intrusion detection and prevention system aims to produce a secure path to the nodes instead of the shortest paths. Since an intruder easily targets the shortest path, trusted paths are preferred. To secure the encryption effectively, this approach discovers all possible paths with their trust length. The highest trust length path is selected as a secured path, and the best route for routing is performed under the Ad hoc On-demand Distance Vector (AODV) protocol. This proposed work uses the AODV protocol for sending encrypted data from source to destination. The original information is obtained from the decryption process and the decryption is the reverse of encryption. M is the original image. The Windmill data on the SCADA network are presented in this proposed method, and the better results are discussed below.


## 6.1. Moore–Penrose Model

The ELM approach is to initialize randomlywj and bj and compute the output weights β=HTT by a Moore–Penrose pseudo inverse. The learned parameters wi, b, H, β, f, and L are used as models to classify the test data set in the intrusion detection system. T denotes the target value, which has attacked data and normal data. ELMs are used to resolve the learning problems of type as given below:(11)Hβ=T,where(12)H=fw1⋅x1+b1⋯fwL⋅x1+bL.⋯.fw1⋅xn+b1⋯fwL⋅xn+bL,β=β1T..βLTT,T=t1T..tLTT.Biased Injection attacks are detected and classified, which detects the proper time, file location, and date of the intrusion. During the classification process, the attacked data are sent to the directory trust file and the system identifies the particular features on which the attack has been carried out. For example, if the speed is high and the obtained power is less, then there is a chance of attack to occur. Then, the normal data are encrypted using Hybrid Elliptic Curve Cryptography (HECC), and the encryption is delineated in the below section.


## 6.2. Encryption Using Hybrid ECC

Security is needed to transfer the information from one source to another destination. The windmill data must be sent in a secure manner to the receiver in this proposed intrusion detection and prevention system. To ensure privacy in transferring the data, the Hybrid Elliptic Curve Cryptography (HECC) is used. The system accepts the input file and it is applied for the ECC encryption process, and then the MD5 algorithm is applied to generate a 64 bit key. On the decryption side, it will get a cipher text and 64 bit key. The collision in the MD5 algorithm can be identified and separated by the Flame Malware. ECC decryption process is applied to the cipher text, and the original message is obtained. If the received 64 bit key and generated 64 bit key are the same, then the message will accept it; otherwise, the message will get discard.The ECC algorithm is a type of mechanism that is adopted in the implementation of public key cryptography. This technique is based on a curve with specific base points and the use of a prime number function. This function is used as a maximum limit. The mathematical representation of the ECC is shown here:(13)y2=x3+ax+b,where a and b are the numerals. In a cryptographic process, the strength of the encryption technique depends purely on the mechanism that is employed for the generation of the key.


## 6.3. Cryptographic Hashing

In the Cryptographic hashing, there are two types of keys that have to be generated. The first step is to generate the public key from the server to encrypt the message. The second step is to generate a private key on the server side to decrypt the message. A pointB is selected as a base point on the curve. Secret key Sk is generated with the multiplication of a private key, a public key, and a base point. A random number KTA and the public key PTA is selected and generated as follows:(14)PTA=KTA∗B.After the generation of the key, the values are encrypted. The encrypted information contains two cipher texts that are mathematically represented as follows:(15)C1+C2=S1∗B+M+S1∗PTA,(16)M=C2−KTA∗C1+Sk.In equation (15) the cipher texts C1 and C2 are generated. C1 and C2 are sent with MD5 that is generated by the 64 bit key. The proposed intrusion detection and prevention system aims to produce a secure path to the nodes instead of the shortest paths. Since an intruder easily targets the shortest path, trusted paths are preferred. To secure the encryption effectively, this approach discovers all possible paths with their trust length. The highest trust length path is selected as a secured path, and the best route for routing is performed under the Ad hoc On-demand Distance Vector (AODV) protocol. This proposed work uses the AODV protocol for sending encrypted data from source to destination. The original information is obtained from the decryption process and the decryption is the reverse of encryption. M is the original image. The Windmill data on the SCADA network are presented in this proposed method, and the better results are discussed below.


## 7. Result and Discussion

The proposed intrusion detection and prevention system is employed in the working platform of MATLAB, and the database is created in an Excel file and comprises 79 different features. In this proposed work, only 40 features are selected during the feature selection phase. The data are collected from the SCADA wind turbines.


### 7.1. Performance Analysis

In this section, the implementation result and its performance are analyzed by applying the statistical measures. For example, sensitivity, specificity, accuracy, precision, recall, and F-Measure of this proposed intrusion detection and prevention system are examined. The performance analysis function has four measurement factors that are commonly used to evaluate the performance of a classification model. In Figure2, the fitness value of different iterations is found and the best output value is taken under consideration.Figure 2
Biased Optimized output for different iterations in terms of fitness and detection rate.
(a)
(b)
(c)
(d)
(e)
(f)In Figure3 the performance metrics of the EELM for the parameters False Discovery Rate (FDR), Positive Prediction Value (PPV), False Positive Rate (FPR), Negative Prediction Value (NPV), and Delay Time is determined. The proposed system results are analyzed in two ways such as the proposed system with the feature selection phase (which is given as the proposed system with optimization) and the proposed system without the feature selection step (which is given as the proposed system without optimization).Figure 3
Performance of the EELM in terms of False Discovery Rate (FDR), Positive Prediction Value (PPV), False Positive Rate (FPR), Negative Prediction Value (NPV), and Delay Time.
(a)
(b)
(c)
(d)
(e)
(f)Table2 shows the performance of the proposed system with optimization and without optimization in terms of precision, recall, and F-Measure. The proposed system with optimization has 0.98 precision, recall, and F-Measure, but without optimization, methodology has 0.89 precision, recall, and F-Measure. Hence, it proves the proposed system with optimization provides better performance. The proposed system with optimization has high value in positive prediction and negative positive prediction, but the proposed system without optimization has high value in false-discovery rate and false-prediction rate. Thus, it concludes that the proposed system with optimization provides a better result when compared with the proposed system without optimization process.Table 2
The performance metrics of the EELM with and without MGWO.
Performance metrics
EELM with MGWO
EELM without MGWO
Sensitivity
0.9818
0.8914
Specificity
0.9909
0.9457
Accuracy
0.9879
0.9276
Precision
0.9728
0.8371
Recall
0.8181
0.9085
F-Measure
0.5621
0.9545Encryption time for the proposed HECC is compared with the existing ECC and RSA. The time needed for the encryption depends on the encryption algorithm to produce a cipher text from a plain text.Figure4 shows the performance of the HECC with the ECC and RSA based on encryption time. From Figure 4 the proposed hybrid ECC has taken a low time in the encryption process, but the existing encryption techniques such as ECC and RSA have taken a long time. Hence, from this comparison, the proposed HECC technique is more efficient with low processing time. Moreover, the proposed HECC is better when compared with the existing encryption techniques.Figure 4
Performance of the HECC with the ECC and RSA based on encryption time.
(a)
(b)
(c)In Figure5, the region of convergence curve related to true-detection rate and false rate of the proposed method are compared with existing CSO and HNA-NN techniques. Hence, from the above figure, the proposed Modified Grey Wolf Optimization gives better performance.Figure 5
Detection rate representation.


## 7.1. Performance Analysis

In this section, the implementation result and its performance are analyzed by applying the statistical measures. For example, sensitivity, specificity, accuracy, precision, recall, and F-Measure of this proposed intrusion detection and prevention system are examined. The performance analysis function has four measurement factors that are commonly used to evaluate the performance of a classification model. In Figure2, the fitness value of different iterations is found and the best output value is taken under consideration.Figure 2
Biased Optimized output for different iterations in terms of fitness and detection rate.
(a)
(b)
(c)
(d)
(e)
(f)In Figure3 the performance metrics of the EELM for the parameters False Discovery Rate (FDR), Positive Prediction Value (PPV), False Positive Rate (FPR), Negative Prediction Value (NPV), and Delay Time is determined. The proposed system results are analyzed in two ways such as the proposed system with the feature selection phase (which is given as the proposed system with optimization) and the proposed system without the feature selection step (which is given as the proposed system without optimization).Figure 3
Performance of the EELM in terms of False Discovery Rate (FDR), Positive Prediction Value (PPV), False Positive Rate (FPR), Negative Prediction Value (NPV), and Delay Time.
(a)
(b)
(c)
(d)
(e)
(f)Table2 shows the performance of the proposed system with optimization and without optimization in terms of precision, recall, and F-Measure. The proposed system with optimization has 0.98 precision, recall, and F-Measure, but without optimization, methodology has 0.89 precision, recall, and F-Measure. Hence, it proves the proposed system with optimization provides better performance. The proposed system with optimization has high value in positive prediction and negative positive prediction, but the proposed system without optimization has high value in false-discovery rate and false-prediction rate. Thus, it concludes that the proposed system with optimization provides a better result when compared with the proposed system without optimization process.Table 2
The performance metrics of the EELM with and without MGWO.
Performance metrics
EELM with MGWO
EELM without MGWO
Sensitivity
0.9818
0.8914
Specificity
0.9909
0.9457
Accuracy
0.9879
0.9276
Precision
0.9728
0.8371
Recall
0.8181
0.9085
F-Measure
0.5621
0.9545Encryption time for the proposed HECC is compared with the existing ECC and RSA. The time needed for the encryption depends on the encryption algorithm to produce a cipher text from a plain text.Figure4 shows the performance of the HECC with the ECC and RSA based on encryption time. From Figure 4 the proposed hybrid ECC has taken a low time in the encryption process, but the existing encryption techniques such as ECC and RSA have taken a long time. Hence, from this comparison, the proposed HECC technique is more efficient with low processing time. Moreover, the proposed HECC is better when compared with the existing encryption techniques.Figure 4
Performance of the HECC with the ECC and RSA based on encryption time.
(a)
(b)
(c)In Figure5, the region of convergence curve related to true-detection rate and false rate of the proposed method are compared with existing CSO and HNA-NN techniques. Hence, from the above figure, the proposed Modified Grey Wolf Optimization gives better performance.Figure 5
Detection rate representation.


## 8. Conclusion

In this paper, a proposed novel model is used for the design of intrusion detection and prevention in the SCADA system. The performance of the proposed system was analyzed using the features which are taken from the real-time windmill database. The performance analysis has shown that the proposed intrusion detection and prevention system has given an incredible rate of accuracy, sensitivity, and specificity. Here, the abnormal biased intruders are detected in SCADA with their encrypted file location, date, and time. The proposed method has the accuracy level of 97.6%. Hence, the proposed intrusion detection and prevention in the SCADA system has more stable performance and the changes in the frequency specifications are identified.



---

*Source: 1082485-2019-11-22.xml*