Abstract:This article presents a statistical approach using entropy and classification-based analysis to detect anomalies in industrial control systems traffic. Several statistical techniques have been proposed to create baselines and measure deviation to detect intrusion in enterprise networks with a centralized intrusion detection approach in mind. Looking at traffic volume alone to find anomalous deviation may not be enough—it may result in increased false positives. The near real-time communication requirements, coupled with the lack of centralized infrastructure in operations technology and limited resources of the sensor motes, require an efficient anomaly detection system characterized by these limitations. This paper presents extended results from our previous work by presenting a detailed cluster-based entropy analysis on selected network traffic features. It further extends the analysis using a classification-based approach. Our detailed entropy analysis corroborates with our earlier findings that, although some degree of anomaly may be detected using univariate and bivariate entropy analysis for Denial of Service (DOS) and Man-in-the-Middle (MITM) attacks, not much information may be obtained for the initial reconnaissance, thus preventing early stages of attack detection in the Cyber Kill Chain. Our classification-based analysis shows that, overall, the classification results of the DOS attacks were much higher than the MITM attacks using two Modbus features in addition to the three TCP/IP features. In terms of classifiers, J48 and random forest had the best classification results and can be considered comparable. For the DOS attack, no resampling with the 60–40 (training/testing split) had the best results (average accuracy of 97.87%), but for the MITM attack, the 80–20 non-attack vs. attack data with the 75–25 split (average accuracy of 82.81%) had the best results.

Periodic Mining of Traffic Information in Industrial Control Networks.

Detecting Anomalies in Distributed Control Systems by Modeling Traffic Behaviors

Analysis of Industrial Control Systems Traffic Based on Time Series

Anomaly Detection Scheme Using Time Series Analysis for Industrial Control Systems

A Novel Approach for Traffic Anomaly Detection in Power Distributed Control System and Substation System.

Behavior Pattern Mining from Traffic and Its Application to Network Anomaly Detection

Anomaly Detection in Industrial Autonomous Decentralized System Based on Time Series.

Event-Based Anomaly Detection for Non-Public Industrial Communication Protocols in SDN-Based Control Systems

Using Graph to Detect Network Traffic Anomaly

Unsupervised Anomaly Detection for Network Data Streams in Industrial Control Systems

Traffic Data Classification to Detect Man-in-the-Middle Attacks in Industrial Control System

Research on Deep Detection Technology of Abnormal Behavior of Power Industrial Control System

Features Extraction Based On Deep Analysis Of Network Packets In Industrial Control Systems

A Physical Signal-Based Anomaly Detection for Industrial Terminal

Anomaly Detection for Modbus over TCP in Control Systems Using Entropy and Classification-Based Analysis

Function-Aware Anomaly Detection Based on Wavelet Neural Network for Industrial Control Communication

A Time-Frequency Detecting Method for Network Traffic Anomalies

An Abnormal Traffic Detection Method in Smart Substations Based on Coupling Field Extraction and DBSCAN

A Continuous Terminal Sliding-Mode Observer-Based Anomaly Detection Approach for Industrial Communication Networks

Recent Advances in Machine Learning-based Anomaly Detection for Industrial Control Networks

Rethinking the Operation Pattern for Anomaly Detection in Industrial Cyber–Physical Systems