Min3GISG: A Synergistic Feature Selection Framework for Industrial Control System Security with the Integrating Genetic Algorithm and Filter Methods

Abstract

Industrial control systems (ICS) are crucial for automating and optimizing industrial operations but are increasingly vulnerable to cyberattacks due to their interconnected nature. High-dimensional ICS datasets pose challenges for effective anomaly detection and classification. This study aims to enhance ICS security by improving attack detection through an optimized feature selection framework that balances dimensionality reduction and classification accuracy. The study utilizes the HAI dataset, comprising 54,000 time series records with 225 features representing normal and anomalous ICS behaviors. A hybrid feature selection approach integrating wrapper and filter methods was employed. Initially, a Genetic Algorithm (GA) identified 118 relevant features. Further refinement was conducted using filter-based methods—Symmetrical Uncertainty (SU), Information Gain (IG), and Gain Ratio (GR)—leading to a final subset of 104 optimal features. These features were used to train classification models (Naive Bayes (NB), Random Forest (RF), and Support Vector Machine (SVM)) with a 70:30 train-test split and tenfold cross-validation. The proposed feature selection method significantly improved classification accuracy, achieving 98.86% (NB), 99.91% (RF), and 97.97% (SVM). Compared to the full dataset (225 features), which yielded 97.51%, 99.93%, and 96.17%, respectively, our optimized feature subset maintained or enhanced classification performance while reducing computational complexity. This research demonstrates the effectiveness of a hybrid feature selection approach in improving ICS anomaly detection. By reducing feature dimensionality without compromising accuracy, the proposed method enhances ICS security, offering a scalable and efficient solution for real-time attack detection.