Abstract:This article presents a statistical approach using entropy and classification-based analysis to detect anomalies in industrial control systems traffic. Several statistical techniques have been proposed to create baselines and measure deviation to detect intrusion in enterprise networks with a centralized intrusion detection approach in mind. Looking at traffic volume alone to find anomalous deviation may not be enough—it may result in increased false positives. The near real-time communication requirements, coupled with the lack of centralized infrastructure in operations technology and limited resources of the sensor motes, require an efficient anomaly detection system characterized by these limitations. This paper presents extended results from our previous work by presenting a detailed cluster-based entropy analysis on selected network traffic features. It further extends the analysis using a classification-based approach. Our detailed entropy analysis corroborates with our earlier findings that, although some degree of anomaly may be detected using univariate and bivariate entropy analysis for Denial of Service (DOS) and Man-in-the-Middle (MITM) attacks, not much information may be obtained for the initial reconnaissance, thus preventing early stages of attack detection in the Cyber Kill Chain. Our classification-based analysis shows that, overall, the classification results of the DOS attacks were much higher than the MITM attacks using two Modbus features in addition to the three TCP/IP features. In terms of classifiers, J48 and random forest had the best classification results and can be considered comparable. For the DOS attack, no resampling with the 60–40 (training/testing split) had the best results (average accuracy of 97.87%), but for the MITM attack, the 80–20 non-attack vs. attack data with the 75–25 split (average accuracy of 82.81%) had the best results.

An Anomaly Detection and Analysis Method for Network Traffic Based on Correlation Coefficient Matrix.

Packet Payload Based Anomalous Network Intrusion Detection

An Intrusion Alarming System Based on Self-Similarity of Network Traffic

Research on the detection of abnormal traffic for multi-channel network

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

An Effective Method for Computer Network Anomaly Detection

Anomaly internet network traffic detection by kernel principle component classifier

Anomaly Detection Based on Traffic Information Structure

Network traffic analysis over clustering-based collective anomaly detection

Correlation Dimension Based Nonlinear Analysis Of Network Traffics With Different Application Protocols

A new connection degree calculation and measurement method for large scale network monitoring.

MSCA: an Unsupervised Anomaly Detection System for Network Security in Backbone Network.

A cross-correlation-based method for spatial-temporal traffic analysis

Abnormal Network Traffic Analysis Based on IP Address Clustering

Network Anomaly Detection: A Survey and Comparative Analysis of Stochastic and Deterministic Methods

Internet Anomaly Detection Based on Complex Network Path

Analysis of Inter-Domain Traffic Correlations: Random Matrix Theory Approach

Network Traffic Decomposition for Anomaly Detection

Analysis Method of Multi-Source Flow Characteristics and Its Application in Anomaly Detection

Survey of Research on Anomaly Detection of Wavelet Analysis Based on Network Traffic

Anomaly Detection for Modbus over TCP in Control Systems Using Entropy and Classification-Based Analysis