An intrusion response approach based on multi-objective optimization and deep Q network for industrial control systems

Industrial control systems (ICSs) are facing increasing network security issues, posing enormous threats and risks to industrial infrastructures. To resist such threats and risks, it is very necessary to formulate a good security protection strategy and restore the attacked system to normal. However, existing ICSs decision-making had some limitations, such as the low performance of the defense strategy selected at the network layer and the lack of strategy selection methods for the physical layer. Because of the above problems, we propose an improved multi-objective optimization algorithm to solve the strategy selection problem of the network layer and also propose a method using deep reinforcement learning to select the physical response strategy according to the state of the physical layer. The proposed method is the first to select the optimal security strategy at the network layer based on different objective weights, and at the same time, it can also alleviate attacks that penetrate to the physical layer to a certain extent. And the effectiveness of the proposed method is demonstrated through simulation experiments.