An Autoencoder-Based Network Intrusion Detection System

An Autoencoder-Based Network Intrusion

Detection System for the SCADA System

Mustafa Altaha1, Jae-Myeong Lee1, Muhammad Aslam2, and Sugwon Hong1

1 Dept. of Computer Engineering, Myongji University, Yongin, R. of Korea 2 Dept. of Electrical Engineering, Myongji University, Yongin, R. of Korea

Email: [email protected]; [email protected]; [email protected]; [email protected]

Abstract—

The intrusion detection system (IDS) is the main

tool to do security monitoring that is one of the security

strategies for the supervisory control and data acquisition

(SCADA) system. In this paper, we develop an IDS based on

the autoencoder deep learning model (AE-IDS) for the SCADA

system. The target SCADA communication protocol of the

detection model is the Distributed Network Protocol 3 (DNP3),

which is currently the most commonly utilized communication

protocol in the power substation. Cyberattacks that we consider

are data injection or modification attacks, which are the most

critical attacks in the SCADA systems. In this paper, we

extracted 17 data features from DNP3 communication, and use

them to train the autoencoder network. We measure accuracy

and loss of detection and compare them with different

supervised deep learning algorithms. The unsupervised AE-IDS

model shows better performance than the other deep learning

IDS models.

Index Terms—Network intrusion detection system, DNP3,

SCADA, autoencoder, deep learning, cybersecurity

I. INTRODUCTION

Security monitoring is one of the integral strategies for

the supervisory control and data acquisition (SCADA)

systems, more generally the industrial control systems

(ICS), and the intrusion detection system (IDS) is a main

tool of doing security monitoring. The anomaly IDS

detection is the process to determine which observed

events are to be identified as abnormal because it has

significant deviation from normal behaviors that is called

‘profile.’ The difficult part is how to decide or derive

profiles which reflect all semantics of the system. Thus,

the main task to do security monitoring is to design

domain-specific IDS which is aware of the target domain

semantics. Depending on how to drive the profiles, all

IDS models for the SCADA/ICS systems come under

three categories: traffic-aware, protocol-aware, and

process-aware [1]-[4].

Encouraged by the success in some fields, many

researchers have begun to focus on constructing IDSs

using machine learning and deep learning methods [5]-

[11]. One of the challenges to develop anomaly IDS

systems is to have capabilities to detect hitherto unknown

anomalies or attacks. For this purpose, recently

unsupervised learning and semi-supervised learning are

gaining attention. At the same time, autoencoder is

Manuscript received November 13, 2020; revised May 15, 2021.

doi:10.12720/jcm.16.6.210-216

highlighted as a useful tool to realize the

unsupervised/semi-supervised learning [12]-[14].

In this paper, we develop an IDS for the SCADA

security based on the autoencoder model. The target of

the detection model is the DNP3 protocol, which is

currently the most commonly utilized communication

protocol in the power substation and other ICS systems

[15].

One of the major obstacles to develop the

SCADA/ICS-specific IDS is to generate datasets that can

reflect real traffic behaviors of the target systems. In this

study, we generate our own dataset based on OpenDNP3

library through GNS3 [16], [17]. Another hinderance to

construct and evaluate IDS for the SCADA/ICS system is

how we simulate attacks. Even though we can find some

information from the past SCADA/ICS cyberattack

incidents, we have to consider attack scenarios including

possible attacks in the future as well as the erstwhile

known attacks. Thus, we should build and evaluate the

proposed IDS models on top of this adversarial/attack

model. In light of these characteristics of the dataset, the

approach using unsupervised learning models has an

advantage over supervised learning models, since they

address imbalanced classification problems between

mostly normal traffic data and very few attack data,

which have to be assumed to be basically unknown. In

this paper, we develop an IDS based on the autoencoder

because the autoencoder model is able to derive a certain

profile, i.e., a normal pattern from a vast amount of

normal traffic.

The paper [18] analyzes all possible attacks against all

layers of the DNP3 protocol stack. In this paper, we focus

only on data injection and modification attacks as well as

DoS attack, since those attacks are considered to be the

most critical attacks that can cause to wreak more

damages to the SCADA/ICS operations. We assume that

data injection and modification attacks would be

materialized via the man-in-the-middle (MITM) attack.

In the DNP3 operation mode, a master, which is a

Remote Terminal Unit (RTU) or a Human Machine

Interface (HMI), does regular polling to remote

outstations, which are programming logic controllers

(PLCs) or Intelligent Electronic Devices (IEDs), in order

to monitor their exact status or any exceptions. For the

static or event polls, a master establishes TCP

connections with outstations. The papers [19], [20] show

Journal of Communications Vol. 16, No. 6, June 2021

©2021 Journal of Communications 210

the dynamics of TCP connections, such as connection

frequency and duration, etc., by collecting traffic from

real power substations. In this paper, we focus on TCP

connection-related behaviors as features, which can

represent normal operation patterns. We extract 17 input

features based on TCP connections to train a model.

Main focus of this paper is to show the performance of

an autoencoder-based IDS (AE-IDS) model with feature

representation based on TCP connections to detect

normal and abnormal behaviors in DNP3 operation

modes. Even though we use restricted dataset derived

from streamlined DNP3 operation modes with specific

attack types, we try to find out how well AE-IDS

performs, comparing with other well-known supervised

learning models.

The rest of this paper is organized as follows. In

section II, we present the proposed IDS model based on

an autoencoder. In section III, we present an experiment

setup and evaluation of the proposed model. And in

section IV, we show comparison results between AE-IDS

and other supervised leaning-based IDS models. Finally,

we suggest conclusion and future work in section V.

II. IDS MODEL BASED ON AUTOENCODER

The IDS design is composed of two main phases: the

extracting phase and the detection phase. In the extracting

phase, the DNP3 packet is processed to extract data

features that represent the behavior of the network. Each

processed DNP3 packet is categorized as normal or

abnormal, and normal packets are used in the training

phase. The detection phase uses the same features, which

are extracted from the extracting phase, as input. The

constructed IDS model predicts which packets belong to

either normal or abnormal.

A. Extracting Phase

The generated dataset has 470 normal instances (TCP

connections), 10 disable unsolicited messages attack

instances, 11 cold restart command attack instances, and

370 DoS attack instances. This gives a total of 861

instances. The total instances or TCP connections are

relatively small, but these instances are enough to capture

normal patterns, which later are used to discern

abnormality of traffic at the experiment.

This generated dataset consists of 17 features, which

are also used similarly by [21]. Among them, the 12

features are related to behaviors of TCP connections. The

reason we choose these features is that TCP connection or

flow-based behavior is more likely to reflect normal

behavior of DNP3 operation, rather than packet-based or

window-based behavior, which are also commonly

considered as an alternative to extract input features to

train. “Fig. 1,” shows the correlation between the input

features and the label to denote attack types. The 12

features are:

1) Duration: How long the connection lasts before it

finishes.

2) Src_bytes: Number of data bytes transferred from

source to destination in a single connection.

3) Dst_bytes: Number of data bytes transferred from

destination to source in a single connection.

4) Flag: Status of the connection, i.e., Normal or Error.

5) Count: Number of connections to the same

destination host as the current connection in the past

two seconds.

6) Srv_count: Number of connections to the same

service (port number) as the current connection in the

past two seconds.

7) Same_srv_rate: The percentage of connections that

were to the same service, among the connections

aggregated in Count.

8) Dst_host_count: Number of host connections to the

destination

9) Dst_host_srv_count: Number of services connecting

to the destination.

10) Srv_rate: The percentage of connections that were to

the same service.

11) Port_rate: The percentage of connections that were to

the same source port, among the connections having

the same port number.

12) Rttd: Round trip time delay is the length of time it

takes for a signal to be sent plus the length of time it

takes for an acknowledgement of that signal to be

received.

Fig. 1. Correlation between label and features

The remaining 5 features are related to DNP3 specific

features as follows:

13) Contains dnp3 packets: A feature indicating if the

connection contains a DNP3 packet.

14) DNP3 payload length: The total length of the DNP3

payload contained within the connection.

15) Min dnp3 payload length: The minimum DNP3

payload length in the connection.

16) Cold restart in dnp3 pkt: A Boolean indicating if

there exists a cold restart or disable unsolicited

message command in the connection.



17) Func code_not_Support_count: A Boolean indicating

changes in function code.

B. Detecting Phase

As a deep learning structure is defined as a sequence of

layers, we create a sequential model and add layers one at

a time until the model network topology reaches at an

optimal level. As we mentioned above, we train an

autoencoder model with normal traffic, and detect

irregularities from an attack dataset at the test stage. The

input layer represents the number of data features that are

extracted from the extracting phase as shown in “Fig. 1.”

Then, after multiple hidden layers, an output layer

produces restored original input features.

The autoencoder model consists of two parts: encoder

and decoder. An encoder aims to compress the input data

into a low-dimensional latent representation, and a

decoder reconstructs the input data from the low-

dimension representation generated by the encoder, based

on the nature of data.

Equation (1) shows the encoding process where the

input is changed into a compressed representation, while

Equation (2) shows the decoding process where the input

is reconstructed from the compressed representation:

h(t) = f(wX(t) + b) (1)

X’(t) = f(w’h(t) + b’) (2)

where h represents the encoded representation or the code

of input X(t); X’(t) is the decoded or reconstructed input;

f is the activation function used by the model; w and w’

are the weights of the encoder and decoder respectively;

and b and b’ are corresponding biases of the encoder and

decoder.

The AE-IDS model consists of an input layer, hidden

encoder/decoder layers, and an output layer. The input

layer consists of 17 features; the final layer is the output

layer that reconstructs the input. As for the activation

function, we use the tanh function, since it is known to

speed up the training [22]. For the hidden layers, the

network should be large enough to capture the structure

of the problem. The optimum number of layers is decided

by a hyperparameter analysis.

III. EVALUATION

A. Exprement Setup

We conduct an experiment on the network, which

consists of one DNP3 master and one outstation, using a

network software emulator, GNS3. The experiment

utilizes two Linux hosts, which are connected to a switch

with negotiated speed of 1000 Mbps. One is working as a

master and the other working as an outstation, both of

which are running OpenDNP3. We also add an attack

host used for penetration testing, which is running Kali

Linux [23]. We assume that an attacker already gained an

access to the DNP3 network, and the Kali Linux node is

used to execute malicious activities. The experiment

focuses on the following attacks: DoS and packet

injection and modification using disable unsolicited

messages, cold restart function codes. For packet

injection/modification attacks, we execute the man-in-

the-middle (MITM) attack by ARP spoofing.

“Fig. 2,” shows DNP3 network configuration in the

experiment setup. To generate the attack traffic, we

assumed that an attacker (Kali Linux) has already

compromised the network. For the DoS attack, hping3 is

used to generate and send DoS traffic to port 20000 (the

DNP3 port) of the outstation node [24]. In order to

perform disable unsolicited messages attack and cold

restart attack, we set up the man-in-the-middle (MITM)

attack by arpspoof [25]. After the success of the MITM

attack, we write a Python TCP hijacking script, which

uses the scapy library to manipulate frames to simulate

attacks of packet injection and modification [26].

In this experiment, the application fields of intercepted

DNP3 packets coming from the master node to the

outstation was altered from a read class to a cold restart

or disable unsolicited in order to compromise normal

operation of the outstation node. The details of the fields

and function codes of the DNP application packet are

explained in the standard [15].

Fig. 2. DNP3 experiment configuration

B. Evaluations

Keras programming environment with TensorFlow at

the backend is used to design the model. Designing an

efficient deep learning model involves a challenging task

called the hyperparameter optimization. First, we carried

out the hyperparameter optimization of the AE-IDS

model. After that, the proposed AE-IDS model was

trained on the prepared dataset to evaluate the

performance of the model: accuracy and loss.

1) Hyperparameter optimization

Optimizing the proposed AE-IDS model was

performed by varying the number of hidden layers and

hidden neurons in each hidden layer. In order to optimize

hyperparameters, we trained the corresponding

autoencoder model for each combination of

hyperparameters. The reconstruction errors, i.e., mean

square error (MSE), on the training data for

hyperparameter optimization are given in “Fig. 3.”

AE-IDS with three hidden layers and 6 Neurons at

each layer is superior to others in terms of loss. Therefore,

we selected 3 hidden layers with 6 hidden neurons as an

optimal AE-IDS model. The optimizer used in the AE



EXPERIMENT AND

model is the Adam optimizer, and tanh is used as the

activation function. The batch size is 8, and epoch is 20.

Fig. 3. MSE for different number of hidden layers and hidden neurons.

2) Model evaluation

“Fig. 4,” shows MSE for normal data, i.e., 470 normal

TCP connections. As shown in this figure, the loss as a

measurement of MSE is less than 0.18 for all connections.

Fig. 4. MSE for normal data.

Fig. 5. MSE for attack data.

“Fig. 5,” shows the loss for attack instances, i.e., the

TCP connections in which attack packets exist. When

there are any attacks, the model shows that the loss is

above 0.01 as shown in this figure.

In order to detect an injection attacks, DNP3 payload

inspection is required. In section II of the detection phase,

we extract from the TCP connection some DNP3 specific

features like “Contains dnp3 pkt”, indicating if the

connection contains a DNP3 packet, or “Cold restart in

dnp3 pkt,” indicating if there exist a cold restart or

disable unsolicited command in the connection, or “Fcns

in conn,” indicating if a function code is changed in a

connection. Thus, if any abnormal activity happens, the

model clearly distinguishes between normal connections

from injected DNP3 attack connections, depending on the

patterns of the connections.

IV. COMPARISON WITH SUPERVISED LEARNING MODELS

In order to investigate the effectiveness of the AE-IDS

model for SCADA security, we compared our approach

with the typical deep neural network methods. The aim of

the evaluation is to find out the performance of AE-IDS

by examining the following measurements, comparing

with other models.

Accuracy = (TP+TN)/ (P + N) (3)

F1_socre = (2 * TP)/ (2 * TP + FP + FN) (4)

Recall = TP/P (5)

Precision = TP/(TP + FP) (6)

where P and N are the actual number of attack and no

attack instances respectively; True Positive (TP) is the

number of attacks classified rightly as attack; True

Negative (TN) is the number of normal instances rightly

classified normal; False Positive (FP) is the number of

normal events misclassified as attacks; and False

Negative (FN) is the number of attacks misclassified as

normal.

In our previous work [21], an intrusion detection

system using the supervised deep learning algorithms,

was proposed to secure the DNP3 network. The proposed

deep learning algorithms were: Feedforward neural

network (FNN), Recurrent neural networks (RNN), Long

short-term memory (LSTM), and convolutional neural

network (CNN). In this paper we compare the AE-IDS

with other supervisory deep learning model-based IDSs

in this specific case of dataset and DNP3 operation

environment.

TABLE I: COMPARISON OF RESULTS

Algorithm Accuracy% Recall% Precision% F1 Score%

FNN 98.75 98.01 98.59 98.12

RNN 98.68 97.68 98.95 98.96

LSTM 98.68 97.68 97.68 97.69

CNN 98.68 97.68 97.68 97.69

AE-IDS 99.70 100.00 99.74 99.49

Table I shows that the performance of AE-IDS is better

than other models in terms of accuracy, recall, and f1-

score. The accuracy of AE-IDS is approximately 99.70%,

which means that there is a chance of around 99% of

detecting any anomalous traffic inside the network. In

this experiment, the loss (MSE) threshold to decide



whether a connection is an attack or not is set to 0.10. So,

as shown in “Fig. 5,” the recall of AE-IDS is 100%.

In addition, another metric to be considered is the loss.

The lower loss means the better model. Loss is not in

percentage as opposed to accuracy and it is a summation

of errors made for each example in training or test sets.

Fig. 6 shows the loss upon training the network. Similar

to accuracy, loss decreases as the number of epochs

increases until it reaches a value of 0.026 for FNN,

0.0264 for RNN, 0.0534 for LSTM, and 0.1363 for CNN.

As for the AE-IDS, this value is 0.0131, which is almost

a negligible loss at the end of the training.

Fig. 6. Model loss during the training of the network

V. CONCLUSION AND FUTURE WORK

The autoencoder is one of the most interesting models

to extract features from the high-dimensional data in the

context of deep learning. In this paper we propose an

autoencoder-based intrusion detection system (AE-IDS)

approach to build an effective and flexible IDS. The main

purpose of this work is to show comparison of the

performance of AE-IDS with other intrusion detection

models based on different supervised deep learning

algorithms. The proposed AE-IDS outperforms other

models in terms of accuracy, recall, f1-score and loss,

proving its efficiency in SCADA security.

However, we cannot generalize this conclusion, since

our experiment is restricted to small dataset and specific

DNP3 operation environments. And superiority of input

features based on TCP connections cannot be concluded

compared to other alternatives, such as packet-based or

window-based. The comparison still needs more

experiment in various operation environments.

As a further work, we need to expand the

attack/adversary model, which can reflect various unseen

and unexpected attacks. We also need to generate more

comprehensive DNP3 dataset to train a model and

validate its efficiency as an IDS for SCADA security,

considering different DNP3 operations reflected in real

substations. In addition, we need to validate and evaluate

autoencoder-based intrusion detection system (AE-IDS)

by comparing with the traditional rule-based or protocol-

based IDSs. We will also further explore how sparsity

constraints are imposed on autoencoder and how sparse

AE-IDS can be designed to further improve intrusion

detection effectiveness.

CONFLICT OF INTEREST

The authors declare no conflict of interest.

AUTHOR CONTRIBUTIONS

M. Al. designed, implemented, evaluated the model,

and wrote the paper. J.-M.L. also worked in the

implementation and evaluation. S.H. supervised and

evaluate the whole process and gave ideas to improve the

article. M.As. supported discussions on improvements

and carried out proof reading of the article. All authors

have read and agreed to the published version of the

manuscript.

ACKNOWLEDGMENT

This research was supported by Korea Electric Power

Corporation. (Grant number: R18XA01)

REFERENCES

[1] S. Hong, J. H. Lee, M. Altaha, and M. Aslam, “Security

monitoring and network management for the power control

network,” I. J. of Electrical and Electronic Engineering &

Telecommunications, vol. 9, no. 5, pp. 356-363, Sep. 2020.

[2] D. Bhamare, M. Zolanvari, A. Erbad, R. Jain, K. Khan, and

N. Meskin, “Cybersecurity for industrial control systems:

A survey,” Computers & Security, vol. 89, February 2020.

[3] Y. Hu, A. Yang, H. Li, Y. Sun, and L. Sun, “A survey of

intrusion detection on industrial control systems,” I. J. of

Distributed Sensor Networks, vol. 14, no. 8, 2018.

[4] A. Volkova, M. Niedermeiser, R. Basmadjian, and H. de

Meer, “Security challenge in control network protocols: A

survey,” IEEE Communications Surveys & Tutorials, vol.

21, no. 1, 2019.

[5] H. Liu and B. Lang, “Machine learning and deep learning

methods for intrusion detection systems: A survey,”

Applied Sciences vol. 9, p. 4396, Oct. 2019.

[6] A. M. Aleesa, B. B. Zaidan, A. A. Zaidan, and N. M. Sahar,

“Review of intrusion detection systems based on deep

learning techniques: Coherent taxonomy, challenges,

motivations, recommendations, substantial analysis and

future direction,” Neural Computing and Application, vol.

32, pp. 8827-9858, Oct. 2019.

[7] B. Chalapathy and S. Chawla. (Jan. 2019). Deep Learning

for Anomaly Detection: A Survey. [Online]. Available:

https://arxiv.org/abs/1901.03407

[8] Y. Luo, Y. Xiao, L. Cheng, G. Peng, and D. Yao. (Mar.

2020). Deep learning-based anomaly detection in cyber-

physical systems: Progress and opportunities. [Online].

Available: https://arxiv.org/abs/2003.13213

[9] R. L. Perez, F. Adamsky, R. Soua, and T. Engel, “Forget

the myth of the air gap: Machine learning for reliable

intrusion detection in SCADA systems,” EAI Endorsed

Trans. on Security and Safety, vol. 6, no. 19, 2019.



[10] H. Yang, L. Cheng, and M. C. Chuah, “Deep-Learning-

Based network intrusion detection for SCADA systems,”

in Proc. IEEE Conference on Communications and

Network Security (CNS), June 2019.

[11] A. Hijazi, E. A. Safadi, and J. M. Flaus, “A deep learning

approach for intrusion detection system in industry

network,” in Proc. Int’l Conference on Big Data and

Cybersecurity Intelligence, Beirut, Lebanon, 2019.

[12] C. Wang, B. Wang, H. Liu, and H. Qu, “Anomaly

detection for industrial control system based on

autoencoder neural network,” Hindawi Wireless

Communications and Mobile Computing, vol. 2020, Aug.

2020.

[13] M. Charib, S. H. Dastgerdi, and M. Sabokron. (Nov. 2019).

AutoIDS: Auto-encoder Based Method for Intrusion

Detection System. [Online]. Available:

https://arxiv.org/pdf/1911.03306.pdf

[14] F. Farahnakian and J. Heikkonen, “A deep auto-encoder

based approach for intrusion detection system,” in Proc.

Int’l Conf. on Advanced Communication Technology

(ICACT), Feb. 2018.

[15] IEEE Standard for Electric Power Systems

Communications Distributed Network Protocol (DNP3),

IEEE Standard Association, IEEE Std 1815-2012.

[16] OpenDNP3. [Online]. Available:

https://www.automatak.com/opendnp3

[17] W. Chris, GNS3 Network Simulation Guide, 1st ed. Packt

Publ., 2013.

[18] S. East, J. Butts, M. Papa, and S. Shenoi, “A taxonomy of

attacks on the DNP3 protocol,” in Critical Infrastructure

Protection III, Springer, Berlin, Heidelberg, March, 2009,

pp. 67-81.

[19] D. Formby, A. Walid, and R. Beyah, “A case study in

power substation network dynamics,” Proc. the ACM on

Measurement and Analysis of Computing Systems, vol. 1,

no. 1, June 2017.

[20] S. S. Jung, D. Formby, C. Day, and R. Beyah, “A first look

at machine-to-machine power grid network traffic,” in

Proc. IEEE Int’l Conf. on Smart Grid Communications,

Nov. 2014.

[21] M. Altaha, J. H. Lee., M. Aslam, and S. Hong, “Network

intrusion detection based on deep neural networks for the

SCADA system,” Journal of Physics: Conference Series,

vol. 1585, July 2020.

[22] H. Zhang, T. W. Weng, P. Y. Chen, C. J. Hsieh, and L.

Daniel, “Efficient neural network robustness certification

with general activation functions,” in Advances in neural

Information Processing Systems, 2018, pp. 4939-4948.

[23] Linux, Kali. [Online]. Available: https://www.kali.org

[24] hping3, [Online]. Available: http://www.hping.org/

[25] Arpspoof, [Online]. https://linux.die.net/man/8/arpspoof

[26] Scapy, [Online]. Available:

http://www.secdev.org/projects/scapy

Copyright © 2021 by the authors. This is an open access article

distributed under the Creative Commons Attribution License

(CC BY-NC-ND 4.0), which permits use, distribution and

reproduction in any medium, provided that the article is

properly cited, the use is non-commercial and no modifications

or adaptations are made.

Mustafa Altaha born on February 7,

1992. He completed his bachelor degree

in computer communication at Al

Mansour University Colleague, Iraq, in

2014. Then he starts his Master program

at Myongji University, Korea, from

2015-2017 at department of information

and communication engineering. He is

currently in his second year of his PhD in computer engineering

department at Myongji University.

He worked as network operated engineer in Earthlink-Co

(biggest Internet service provider in Iraq) from 2014-2015.

During his master degree program, he published on OFDM

systems, and during his first year as Ph.D. he published an

articles on fault tolerance in PTP systems. His current research,

is about implementing intrusion detection in SCADA system by

using deep learning algorithms.

MSc. Altaha was awarded the first in Iraq in cisco national net-

riders competition in network skills in 2014 and, awarded the

fifth in Middle East in cisco international net-riders competition

in 2014.

Jae-Myeong Lee was born in Seoul, S.

Korea on September 28, 1992. He

received a Bachelor’s degree in computer

engineering from Myongji University,

Korea, in 2018. Then he started his

Master’s degree program in computer

engineering at Myongji University,

Korea, from 2018. He is now researching

about Machine Learning, Deep Learning, Computer Security,

Smart Grid, and SCADA Security, under supervision of Prof.

Sugwon Hong.

He was enthusiastic about computer programming from a very

young age. In 2009, He was awarded Microsoft Most Valuable

Professional (MVP) for Visual Basic by Microsoft, which was

the youngest record in Korea.

Muhammad Aslam born on December

12, 1991. He completed his bachelor

degree in electrical engineering at

University of Engineering and

Technology, Peshawar, Pakistan, in 2013.

He completed his Master program at

Myongji University, Korea, from 2015-

2017 at department of electrical

engineering. He is currently in his 3rd year of PhD in electrical

engineering department at Myongji University.

During his Masters, he worked with Next-Generation Power

Technology (NPTC) research center in Myongji University,

where he worked on power system protection, power system

load flow calculation and Artificial Intelligence (AI). Currently,



https://linux.die.net/man/8/arpspoof

https://creativecommons.org/licenses/by-nc-nd/4.0/

he is working to apply AI into power system and network

security

Sugwon Hong was born in Incheon, S.

Korea. He received the B.S. degree in

physics from Seoul National University,

Seoul, Korea, in 1979, and the M.S. and

Ph.D. degrees in computer science from

North Carolina State University, Raleigh,

USA, in 1988 and 1992, respectively.

His employment experience includes

Korea Institute of Science and Technology (KIST), Software

Development Center; Korea Energy Economics Institute (KEEI);

SK Innovation Co., Ltd. (formerly Korea Oil Company);

Electronic and Telecommunication Research Institute (ETRI).

Currently he is a professor in the department of computer

engineering, Myongji University, Yongin, S. Korea, where he

has been since 1995. His current research interest are cyber

security and smart grid.



Documents

An Autoencoder-Based Network Intrusion Detection System