Explainable Artificial Intelligence (XAI): Towards Malicious SCADA Communications

Critical infrastructure Supervisory Control and Data Acquisition (SCADA) systems have been designed to operate on closed, proprietary networks where a malicious insider posed the greatest threat potential. There is an emergence of new threat scenarios of command and data injection. Multiple machine learning methods have been used to predict instances of command and data injection attack scenarios. The models often lack transparency. The black-box nature of these systems allows powerful predictions, but it cannot be directly explained. Understanding the reasons behind predictions is, however, quite important in assessing machine decisions, predictions and justify their reliability. More an attack is threatening the more explainable it should be. We need to explain attacks on both a local and global scope to get complete transparency against the attack. We will apply global interpretability methods like Partial Dependence Plots(PDP), Individual Conditional Expectations (ICE), Decision Trees to explain the whole logic of a model. For more menacing attacks we use local interpretability methods like Local Interpretable Model-Agnostic Explanation (LIME) to explain the reasons for specific decisions a model is taking.