Implementation of Machine Learning Models to Classify Security Incidents in Industrial Systems

This research is focused on classifying security data in industrial control systems (ICS) using machine learning models. Currently, ICS mainly focus on the technical and industrial operation of technological infrastructures, neglecting their security. This practice is dangerous as it affects various critical sectors of society. Due to the scarce information and difficult access to security incident data in industrial systems, this study employed web scraping to create a data set called 'SI ICS UPS 2023' with 2914 records of non-null security incidents in text format. For the labeling phase, regular expressions were applied to standardize the data set and propose two main classes of interest in this study. Data cleaning and processing stages were implemented, followed by the training of four machine learning models from scratch. The best-performing model in terms of the area under the curve (AUC) was the Random Forest with a score of 0.76 and an accuracy of 71.20%. These results demonstrate the efficiency of automating processes for the collection and classification of cyber incident data in industrial environments using techniques like web scraping and the utilization of machine learning models.