  False alerts due to misconfigured/ compromised IDS in ICS networks can lead
to severe economic and operational damage. To solve this problem, research has
focused on leveraging deep learning techniques that help reduce false alerts.
However, a shortcoming is that these works often require or implicitly assume
the physical and cyber sensors to be trustworthy. Implicit trust of data is a
major problem with using artificial intelligence or machine learning for CPS
security, because during critical attack detection time they are more at risk,
with greater likelihood and impact, of also being compromised. To address this
shortcoming, the problem is reframed on how to make good decisions given
uncertainty. Then, the decision is detection, and the uncertainty includes
whether the data used for ML-based IDS is compromised. Thus, this work presents
an approach for reducing false alerts in CPS power systems by dealing
uncertainty without the knowledge of prior distribution of alerts.
Specifically, an evidence theoretic based approach leveraging Dempster Shafer
combination rules are proposed for reducing false alerts. A multi-hypothesis
mass function model is designed that leverages probability scores obtained from
various supervised-learning classifiers. Using this model, a
location-cum-domain based fusion framework is proposed and evaluated with
different combination rules, that fuse multiple evidence from inter-domain and
intra-domain sensors. The approach is demonstrated in a cyber-physical power
system testbed with Man-In-The-Middle attack emulation in a large-scale
synthetic electric grid. For evaluating the performance, plausibility, belief,
pignistic, etc. metrics as decision functions are considered. To improve the
performance, a multi-objective based genetic algorithm is proposed for feature
selection considering the decision metrics as the fitness function.
