  We propose a novel hierarchical online intrusion detection system (HOIDS) for
supervisory control and data acquisition (SCADA) networks based on machine
learning algorithms. By utilizing the server-client topology while keeping
clients distributed for global protection, high detection rate is achieved with
minimum network impact. We implement accurate models of normal-abnormal binary
detection and multi-attack identification based on logistic regression and
quasi-Newton optimization algorithm using the Broyden-Fletcher-Goldfarb-Shanno
approach. The detection system is capable of accelerating detection by
information gain based feature selection or principle component analysis based
dimension reduction. By evaluating our system using the KDD99 dataset and the
industrial control system dataset, we demonstrate that HOIDS is highly
scalable, efficient and cost effective for securing SCADA infrastructures.
