Abstract:Industrial cyber-physical systems (ICPSs) are facing increasing cyber threats that can cause catastrophes in the physical systems. Efficient network traffic anomaly detection is essential for guaranteeing the system's security and reliability. However, existing research on network traffic anomaly detection for ICPS has several limitations. First, most traffic anomaly detection models focus on centralized detection. Thus, all traffic packets have to be uploaded to the control center for detection, which leads to a heavy traffic load. However, real-time and reliable communication is crucial to ICPSs. The heavy traffic load may cause communication delays or packets lost by corruption. Second, Seasonal AutoRegressive Integrated Moving Average (SARIMA) is popular in ICPS network traffic anomaly detection. However, most SARIMA-based detection models can only detect anomalous traffic once. Thus, they are unable to detect anomalies continuously and are not suitable for actual ICPS. Third, the features extracted from network traffic affect the classification performance. However, most existing feature extraction models cannot sufficiently extract traffic features, leading to poor detection performance. To address the limitations above, this paper proposes a cloud-edge coordinated network traffic anomaly detection approach. The proposed approach consists of a set of anomalous traffic alarm models deployed in the edge areas and an anomalous traffic analysis model deployed in the cloud. The former is implemented based on Improved Online SARIMA (IOSARIMA) algorithm that can detect anomalous traffic continuously and upload it to the cloud for further analysis, filtering massive normal traffic packets and making traffic load smaller. The anomalous traffic analysis model consists of a feature extraction algorithm and a Convolutional Neural Network (CNN) classifier, which can sufficiently extract traffic features and identify the attack types precisely. The proposed anomaly detection approach is extensively evaluated on a realistic ICPS testbed, including 3 edges (i.e., power generation, power transmission and power distribution) and a cloud consisting of an engineering workstation and a Supervisory Control And Data Acquisition (SCADA) workstation. The experimental results confirm the smaller traffic load and better detection performance, compared with the existing detection models.

Modeling Network Traffic for Traffic Matrix Estimation and Anomaly Detection Based on Bayesian Network in Cloud Computing Networks.

Anomaly Secure Detection Methods by Analyzing Dynamic Characteristics of the Network Traffic in Cloud Communications

Traffic matrix estimation approach based on partial direct measurements in large-scale IP backbone networks

Statistics based network traffic model and anomaly traffic detection

Spatio-Temporal Network Traffic Estimation and Anomaly Detection Based on Convolutional Neural Network in Vehicular Ad-Hoc Networks

A Novel Network Tomography Approach for Traffic Matrix Estimation Problem in Large-Scale IP Backbone Networks

Structured Nonnegative Matrix Factorization for Traffic Flow Estimation of Large Cloud Networks

A Bayes Theory-Based Modeling Algorithm to End-to-end Network Traffic

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

Traffic Matrix Prediction And Estimation Based On Deep Learning For Data Center Networks

A Network Traffic Anomaly Detection Method Based on Gaussian Mixture Model

Traffic Model Analysis for Anomaly Detection

Network Anomaly Detection Based on Statistical Approach and Time Series Analysis

Behavior Pattern Mining from Traffic and Its Application to Network Anomaly Detection

Research on the detection of abnormal traffic for multi-channel network

Network traffic anomaly detection based on catastrophe theory

Traffic matrix prediction and estimation based on deep learning in large-scale IP backbone networks.

An Anomaly Detection and Analysis Method for Network Traffic Based on Correlation Coefficient Matrix.

Cloud-edge Coordinated Traffic Anomaly Detection for Industrial Cyber-Physical Systems

Anomaly network traffic detection algorithm based on information entropy measurement under the cloud computing environment

An Adaptive Profile-Based Approach for Detecting Anomalous Traffic in Backbone.