Abstract:This article presents a statistical approach using entropy and classification-based analysis to detect anomalies in industrial control systems traffic. Several statistical techniques have been proposed to create baselines and measure deviation to detect intrusion in enterprise networks with a centralized intrusion detection approach in mind. Looking at traffic volume alone to find anomalous deviation may not be enough—it may result in increased false positives. The near real-time communication requirements, coupled with the lack of centralized infrastructure in operations technology and limited resources of the sensor motes, require an efficient anomaly detection system characterized by these limitations. This paper presents extended results from our previous work by presenting a detailed cluster-based entropy analysis on selected network traffic features. It further extends the analysis using a classification-based approach. Our detailed entropy analysis corroborates with our earlier findings that, although some degree of anomaly may be detected using univariate and bivariate entropy analysis for Denial of Service (DOS) and Man-in-the-Middle (MITM) attacks, not much information may be obtained for the initial reconnaissance, thus preventing early stages of attack detection in the Cyber Kill Chain. Our classification-based analysis shows that, overall, the classification results of the DOS attacks were much higher than the MITM attacks using two Modbus features in addition to the three TCP/IP features. In terms of classifiers, J48 and random forest had the best classification results and can be considered comparable. For the DOS attack, no resampling with the 60–40 (training/testing split) had the best results (average accuracy of 97.87%), but for the MITM attack, the 80–20 non-attack vs. attack data with the 75–25 split (average accuracy of 82.81%) had the best results.

Using Cross Entropy to Detect and Classify Network Anomalous Traffic

Packet Payload Based Anomalous Network Intrusion Detection

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

Abnormal Network Traffic Detection Algorithm Based on Improved Convolutional Neural Network

An Intrusion Alarming System Based on Self-Similarity of Network Traffic

Anomaly network traffic detection algorithm based on information entropy measurement under the cloud computing environment

Worm Intrusion Alarm Modeling Based on Network Traffic Character

Anomaly Detection Based on Traffic Information Structure

Research on the detection of abnormal traffic for multi-channel network

Analysis Method of Multi-Source Flow Characteristics and Its Application in Anomaly Detection

Anomaly Detection for Modbus over TCP in Control Systems Using Entropy and Classification-Based Analysis

Adjustable Piecewise Entropy for Network Traffic Anomaly Detection

Survey of Research on Anomaly Detection of Wavelet Analysis Based on Network Traffic

An Anomaly Detection and Analysis Method for Network Traffic Based on Correlation Coefficient Matrix.

Network Traffic Classification Algorithm Based on Spectral Clustering

A Network Traffic anomaly Detection method based on CNN and XGBoost

Traffic Classification - Towards Accurate Real Time Network Applications

MBST: Detecting Packet-Level Traffic Anomalies by Feature Stability

Monitoring Abnormal Network Traffic Based on Blind Source Separation Approach

Ceff: An Efficient Approach For Traffic Anomaly Detection And Classification

High-speed anomaly traffic detection based on staged frequency domain features