Abstract / Description
Critical Infrastructures (CIs) rely on Industrial Control Systems (ICSs) and Supervisory Control and Data Acquisition (SCADA) systems for real-time monitoring and automation. However, their increasing connectivity has exposed them to sophisticated cyber threats. To address these risks, Intrusion Detection Systems (IDSs) must be both accurate and computationally efficient. Traditional IDSs often suffer from high processing overhead due to the inclusion of irrelevant network features. Method: This study introduces a novel feature selection approach, Statistical Parameters - Selective Promising Feature Selection (SP-SPFS), which utilizes statistical ranking to identify the most relevant features for cyberattack detection in CI environments. Comparison & Dataset: SP-SPFS is evaluated against established techniques such as Weighted Feature Importance (WFI) and Forward Feature Selection (FFS) using tree-based classifiers on two datasets: the Mississippi State University (MSU) Gas Pipeline dataset and a Water Storage Tank dataset. Results: SP-SPFS achieves a detection accuracy of 99.22% with only 14 features on the MSU Gas Pipeline dataset, reducing execution time to 24.24 seconds. Cluster-specific evaluations further validate its effectiveness, with SP-SPFS-RF attaining up to 99.61% accuracy across Command, Function, and Response clusters. On the Water Storage Tank dataset, the method achieved an accuracy of 98.56% and an F1-score of 97.35% with 11 features out of 24 original features. Significance: These results highlight the potential of SP-SPFS to improve real-time IDS performance with minimal feature sets and low computational cost, offering a scalable and robust solution for protecting critical infrastructure from evolving cyber threats.