An adaptive ensemble classification framework for real-time data streams by distributed control systems

Smart Grids are critical infrastructure networks. They play a critical role in the survival of our postmodern economies, as all other areas depend on their availability. An interruption in their operation may have a direct impact on the availability of other services (e.g., health, transportation). The problem is particularly intense when no backup networks are available, or the required recovery time is beyond backup autonomy. The transition to a decentralized management and control system for these networks requires digital technologies, advanced interconnected system communications, and Internet access. These technologies expose critical infrastructure networks to external threats that require careful assessment of cyber-security risks and appropriate countermeasures. An important factor that enhances the range of threats is the heterogeneity of Smart Grids, which incorporate industrial control systems such as the SCADA, distributed control system, and programmable logic controllers to which security improvements may not have been made since they were installed. Υet, another serious problem arises from the fact that older technologies were designed at times when cyber-security was not part of their technical design specifications. At the same time, it should be seriously considered that many of the systems of these networks that can be cyber-attacked may not be easily disconnected, as this could potentially lead to generalized operational problems. In this scientific research, a sophisticated active security framework is proposed, which is based solely on advanced computational intelligence methods and concerns the digital security of critical infrastructure networks. Specifically, this research introduces a sophisticated adaptive ensemble classification framework for real-time data streams by distributed control systems. It is a “Kappa” architecture framework that is based on a two-step online ensemble learning model based on bagging and boosting methods. The aim is performance of real-time analysis and evaluation of data flows from Smart Grids, toward the effective identification of APT attacks.