Abstract:In Industrial Cyber-Physical Systems (ICPSs), the attacker can intrude into the cyber system through many penetration tools and attack the physical system. Payload-based traffic anomaly detection is a popular technique against these attacks. Due to the imbalanced distribution of normal and attack samples in ICPS, existing payload-based detection methods are mostly implemented based on unsupervised learning, typically comprising a word segmentation model and an unsupervised classifier. However, existing methods may disrupt semantic correlations and face challenges in extracting com-plex payload dependence relationships. To address these issues, this paper proposes a traffic anomaly detection approach, which consists of a data preprocessing model, an unsupervised word segmentation model, and an unsupervised classification model based on autoencoder. The unsupervised word segmentation model utilizes Long Short-Term Memory (LSTM) to calculate the probability of each word segmentation combination, effectively addressing the issue of inaccurate segmentation results in existing payload segmentation models. The unsupervised classification model, which combines 1D-Convolutional Neural Network (1D-CNN) and Bidirectional Encoder Representation from Transformers (BERT), addresses the challenge of extracting complex payload dependence relationships in existing classification models. The proposed detection approach is evaluated using a Cyber-Physical Attack Dataset (CPAD). Compared with the state-of-the-art detection approaches, the proposed approach has shown a significant improvement in Precision, with an increase of 18.83%. Additionally, the Recall has also been substantially enhanced, with a gain of 22.3%. Overall, the F1 has demonstrated a comprehensive improvement of 20.60%. (c) 2023 Elsevier B.V. All rights reserved.

Unsupervised Abnormal Traffic Detection through Topological Flow Analysis

Flow Interaction Graph Analysis: Unknown Encrypted Malicious Traffic Detection

Statistical Techniques for Detecting Cyberattacks on Computer Networks Based on an Analysis of Abnormal Traffic Behavior

Monitoring Abnormal Network Traffic Based on Blind Source Separation Approach

Abnormal Traffic Detection: Traffic Feature Extraction and DAE-GAN With Efficient Data Augmentation

NETWORK TRAFFIC ANOMALY DETECTION BY DIMENSIONALITY REDUCTION METHODS

An empirical study for the traffic flow rate prediction-based anomaly detection in software-defined networking: a challenging overview

Research on the detection of abnormal traffic for multi-channel network

Research on Dynamic Data Flow Anomaly Detection based on Machine Learning

A Graph Construction Method for Anomalous Traffic Detection with Graph Neural Networks Using Sets of Flow Data

Traffic Anomaly Detection Using Deep Semi-Supervised Learning at the Mobile Edge

Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis

MSCA: an Unsupervised Anomaly Detection System for Network Security in Backbone Network.

A traffic anomaly detection approach based on unsupervised learning for industrial cyber-physical system

Data-Driven Detection of Anomalies and Cascading Failures in Traffic Networks

Unsupervised Anomalous Traffic Detection Based on Cascading Representation and Multiple-Clustering

Semi-Supervised Learning for Anomaly Traffic Detection via Bidirectional Normalizing Flows

Unsupervised Anomaly Detection and Localization Based on Two-Hierarchy Normalizing Flow

SAWANT: Smart Window Based Anomaly Detection Using Netflow Traffic

Anomaly Detection on Collective Moving Patterns: Manifold Learning Based Analysis of Traffic Streams.

Using Graph Theory for Improving Machine Learning-based Detection of Cyber Attacks