Abstract:Industrial cyber-physical systems (ICPSs) are facing increasing cyber threats that can cause catastrophes in the physical systems. Efficient network traffic anomaly detection is essential for guaranteeing the system's security and reliability. However, existing research on network traffic anomaly detection for ICPS has several limitations. First, most traffic anomaly detection models focus on centralized detection. Thus, all traffic packets have to be uploaded to the control center for detection, which leads to a heavy traffic load. However, real-time and reliable communication is crucial to ICPSs. The heavy traffic load may cause communication delays or packets lost by corruption. Second, Seasonal AutoRegressive Integrated Moving Average (SARIMA) is popular in ICPS network traffic anomaly detection. However, most SARIMA-based detection models can only detect anomalous traffic once. Thus, they are unable to detect anomalies continuously and are not suitable for actual ICPS. Third, the features extracted from network traffic affect the classification performance. However, most existing feature extraction models cannot sufficiently extract traffic features, leading to poor detection performance. To address the limitations above, this paper proposes a cloud-edge coordinated network traffic anomaly detection approach. The proposed approach consists of a set of anomalous traffic alarm models deployed in the edge areas and an anomalous traffic analysis model deployed in the cloud. The former is implemented based on Improved Online SARIMA (IOSARIMA) algorithm that can detect anomalous traffic continuously and upload it to the cloud for further analysis, filtering massive normal traffic packets and making traffic load smaller. The anomalous traffic analysis model consists of a feature extraction algorithm and a Convolutional Neural Network (CNN) classifier, which can sufficiently extract traffic features and identify the attack types precisely. The proposed anomaly detection approach is extensively evaluated on a realistic ICPS testbed, including 3 edges (i.e., power generation, power transmission and power distribution) and a cloud consisting of an engineering workstation and a Supervisory Control And Data Acquisition (SCADA) workstation. The experimental results confirm the smaller traffic load and better detection performance, compared with the existing detection models.

An Improved ARIMA-Based Traffic Anomaly Detection Algorithm for Wireless Sensor Networks

Research on Vehicle Detection and Classification Algorithm Based on Wireless Sensor Networks

Congestion Avoidance, Detection and Alleviation in Wireless Sensor Networks

Simulation of Artificial Intelligence Algorithm Based on Network Anomaly Detection and Wireless Sensor Network in Sports Cardiopulmonary Monitoring System

An On-Road Wireless Sensor Network Approach for Urban Traffic State Monitoring

Cloud-edge Coordinated Traffic Anomaly Detection for Industrial Cyber-Physical Systems

Weighted-Neighborhood-Information-Network-Enabled Anomaly Detection Method for Electronic Sensors and Sensor Networks

Anomaly Detection in Wireless Sensor Networks Based on KNN

Research on Anomaly Network Detection Based on Self-Attention Mechanism

Learning the Dynamics for Anomaly Detection in Wireless Sensor Networks.

A traffic data collection and analysis method based on wireless sensor network

Traffic Flow Anomaly Detection Based on Wavelet Denoising and Support Vector Regression

Autoregressive integrated moving average model–based secure data aggregation for wireless sensor networks

A Realtime Dynamic Traffic Control System Based on Wireless Sensor Network

Detection and classification of sensor anomalies for simulating urban traffic scenarios

Anomaly Detection in Traffic Scenes via Spatial-aware Motion Reconstruction

Data-Driven Anomaly Detection Approach for Time-Series Streaming Data

Research on Network Traffic Anomaly Detection Algorithm

Research on Network Security Filtering Model and Key Algorithms Based on Network Abnormal Traffic Analysis

Web-Based Application for Traffic Anomaly Detection Algorithm

Traffic Anomaly Detection in Intelligent Transport Applications with Time Series Data Using Informer