Abstract:Industrial cyber-physical systems (ICPSs) are facing increasing cyber threats that can cause catastrophes in the physical systems. Efficient network traffic anomaly detection is essential for guaranteeing the system's security and reliability. However, existing research on network traffic anomaly detection for ICPS has several limitations. First, most traffic anomaly detection models focus on centralized detection. Thus, all traffic packets have to be uploaded to the control center for detection, which leads to a heavy traffic load. However, real-time and reliable communication is crucial to ICPSs. The heavy traffic load may cause communication delays or packets lost by corruption. Second, Seasonal AutoRegressive Integrated Moving Average (SARIMA) is popular in ICPS network traffic anomaly detection. However, most SARIMA-based detection models can only detect anomalous traffic once. Thus, they are unable to detect anomalies continuously and are not suitable for actual ICPS. Third, the features extracted from network traffic affect the classification performance. However, most existing feature extraction models cannot sufficiently extract traffic features, leading to poor detection performance. To address the limitations above, this paper proposes a cloud-edge coordinated network traffic anomaly detection approach. The proposed approach consists of a set of anomalous traffic alarm models deployed in the edge areas and an anomalous traffic analysis model deployed in the cloud. The former is implemented based on Improved Online SARIMA (IOSARIMA) algorithm that can detect anomalous traffic continuously and upload it to the cloud for further analysis, filtering massive normal traffic packets and making traffic load smaller. The anomalous traffic analysis model consists of a feature extraction algorithm and a Convolutional Neural Network (CNN) classifier, which can sufficiently extract traffic features and identify the attack types precisely. The proposed anomaly detection approach is extensively evaluated on a realistic ICPS testbed, including 3 edges (i.e., power generation, power transmission and power distribution) and a cloud consisting of an engineering workstation and a Supervisory Control And Data Acquisition (SCADA) workstation. The experimental results confirm the smaller traffic load and better detection performance, compared with the existing detection models.

Anomaly Detection Method Based on Bilateral Features for CPPS

Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems

An Ensemble Learning-Based Cyber-Attacks Detection Method of Cyber-Physical Power Systems

Analysis of Malware-Induced Cyber Attacks in Cyber-Physical Power Systems

Anomoly Detection for PLC Based on Magnetic Side Channel

A packet payload anomaly detection approach for cyber-physical power systems

Cyber Protection for Malware Attack Resistance in Cyber-Physical Power Systems

An Unsupervised Framework for Anomaly Detection in a Water Treatment System

Anomaly detection method based on penalty least squares algorithm and time window entropy for Cyber-Physical Systems

A Collaborative Characteristic Event Sequence Based Identification Method for Cyberattacks in Cyber-Physical System

Coordinated Cyber-Attack Detection Model of Cyber-Physical Power System Based on the Operating State Data Link

Deep Learning-based Anomaly Detection in Cyber-physical Systems

Digital-Twin-Based CPS Anomaly Diagnosis and Security Defense Countermeasure Recommendation

Detection and mitigation of coordinated cyber-physical attack in CPPS

IEEE 1815.1-Based Power System Security With Bidirectional RNN-Based Network Anomalous Attack Detection for Cyber-Physical System

The abnormal traffic detection scheme based on PCA and SSH

Cyber Attack Detection of I&C Systems in NPPS Based on Physical Process Data

Digital Twin-based Anomaly Detection in Cyber-physical Systems

Cloud-edge Coordinated Traffic Anomaly Detection for Industrial Cyber-Physical Systems

An Unsupervised Spatiotemporal Graphical Modeling Approach to Anomaly Detection in Distributed CPS

Cyber attack estimation and detection for cyber-physical power systems