Artifact: One IDS is not Enough! Exploring Ensemble Learning for Industrial Intrusion Detection

Zenodo (CERN European Organization for Nuclear Research)

Abstract

This collection resembles the artifact of our publication, in which we assessed whether ensembles of unsupervised Industrial Intrusion Detection Systems (IIDSs) could be superior to deploying a single IIDS. To this end, eight IIDSs from related work were applied to two different datasets (SWaT and WADI). The output of these IIDSs, i.e., their alerts on whether an attack is present, resemble the foundation for our analyses. This artifact contains the alerts of the eight IIDSs on the two datasets used for training the different ensembles and the configurations of the respective ensemble methods. Note that we can not redistribute the original dataset! Please refer to iTrust or the IPAL Dataset repository to obtain these.

Authors 5

1. Konrad Wolsing Aachen Fraunhofer FKIE &

   Fraunhofer Institute for Communication, Information Processing and Ergonomics · RWTH Aachen University

   Affiliation as printed

   Fraunhofer FKIE & RWTH Aachen University

2. Dominik Kus Aachen

   RWTH Aachen University

   Affiliation as printed

   RWTH Aachen University

3. Eric Wagner Aachen Fraunhofer FKIE &

   Fraunhofer Institute for Communication, Information Processing and Ergonomics · RWTH Aachen University

   Affiliation as printed

   Fraunhofer FKIE & RWTH Aachen University

4. Jan Pennekamp Aachen

   RWTH Aachen University

   Affiliation as printed

   RWTH Aachen University

5. Martin Henze Aachen

   Fraunhofer Institute for Communication, Information Processing and Ergonomics · RWTH Aachen University

   Affiliation as printed

   RWTH Aachen University & Fraunhofer FKIE