Abstract:Industrial cyber-physical systems (ICPSs) are facing increasing cyber threats that can cause catastrophes in the physical systems. Efficient network traffic anomaly detection is essential for guaranteeing the system's security and reliability. However, existing research on network traffic anomaly detection for ICPS has several limitations. First, most traffic anomaly detection models focus on centralized detection. Thus, all traffic packets have to be uploaded to the control center for detection, which leads to a heavy traffic load. However, real-time and reliable communication is crucial to ICPSs. The heavy traffic load may cause communication delays or packets lost by corruption. Second, Seasonal AutoRegressive Integrated Moving Average (SARIMA) is popular in ICPS network traffic anomaly detection. However, most SARIMA-based detection models can only detect anomalous traffic once. Thus, they are unable to detect anomalies continuously and are not suitable for actual ICPS. Third, the features extracted from network traffic affect the classification performance. However, most existing feature extraction models cannot sufficiently extract traffic features, leading to poor detection performance. To address the limitations above, this paper proposes a cloud-edge coordinated network traffic anomaly detection approach. The proposed approach consists of a set of anomalous traffic alarm models deployed in the edge areas and an anomalous traffic analysis model deployed in the cloud. The former is implemented based on Improved Online SARIMA (IOSARIMA) algorithm that can detect anomalous traffic continuously and upload it to the cloud for further analysis, filtering massive normal traffic packets and making traffic load smaller. The anomalous traffic analysis model consists of a feature extraction algorithm and a Convolutional Neural Network (CNN) classifier, which can sufficiently extract traffic features and identify the attack types precisely. The proposed anomaly detection approach is extensively evaluated on a realistic ICPS testbed, including 3 edges (i.e., power generation, power transmission and power distribution) and a cloud consisting of an engineering workstation and a Supervisory Control And Data Acquisition (SCADA) workstation. The experimental results confirm the smaller traffic load and better detection performance, compared with the existing detection models.

HorusEye: A Realtime IoT Malicious Traffic Detection Framework using Programmable Switches

An LSTM Based Malicious Traffic Attack Detection in Industrial Internet

IoTa: Fine-Grained Traffic Monitoring for IoT Devices Via Fully Packet-Level Models

DeviceRadar: Online IoT Device Fingerprinting in ISPs using Programmable Switches

IoT Equipment Monitoring System Based on C5.0 Decision Tree and Time-Series Analysis

Intrusion Detection using Network Traffic Profiling and Machine Learning for IoT

Detecting While Accessing:A Semi-Supervised Learning-Based Approach for Malicious Traffic Detection in Internet of Things

ADRIoT: an Edge-Assisted Anomaly Detection Framework Against IoT-Based Network Attacks

Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis

HSESR: Hierarchical Software Execution State Representation for Ultra-Low-Latency Threat Alerting over Internet of Things

Your Smart Home Can't Keep a Secret: Towards Automated Fingerprinting of IoT Traffic with Neural Networks

A lightweight and efficient IoT intrusion detection method based on feature grouping

Design and Implementation of IoT DDoS Attacks Detection System based on Machine Learning

A data-driven approach for intrusion and anomaly detection using automated machine learning for the Internet of Things

Soter: Deep Learning Enhanced In-Network Attack Detection Based on Programmable Switches

Securing 5G/6G IoT Using Transformer and Personalized Federated Learning: an Access-Side Distributed Malicious Traffic Detection Framework

Enhancing Cybersecurity in IoT Networks: A Deep Learning Approach to Anomaly Detection

High-speed anomaly traffic detection based on staged frequency domain features

IoT-KEEPER: Detecting Malicious IoT Network Activity Using Online Traffic Analysis at the Edge

Cloud-edge Coordinated Traffic Anomaly Detection for Industrial Cyber-Physical Systems

A method based on hierarchical spatiotemporal features for trojan traffic detection