A novel industrial intrusion detection method based on threshold-optimized CNN-BiLSTM-attention using ROC curve

In recent years, many researchers have proposed many intrusion detection methods to protect the industrial network. However, there are two existing problems among them: one is that they only consider the overall accuracy rate (AC) while ignoring the problem of class imbalance; another one is that they have considered the problem of class imbalance, but the detection rate (DR) is low and false positive rate (FR) is high for minority classes. In order to improve AC and DR of minority classes, we propose a method called threshold-optimized CNN-BiLSTM-Attention that combines CNN-BiLSTM-Attention model, with threshold modification method based on receiver operating characteristic (ROC) curve. In this method, we use CNN-BiLSTM-Attention model as a classifier and modify threshold of the classifier through ROC curve. To evaluate the proposed method, we have performed experiments on the standard industrial data set. And the experimental results show that the proposed method can improve AC and the DR of minority classes at low FR, which is better than other intrusion detection methods.