Abstract:Industrial cyber-physical systems (ICPSs) are facing increasing cyber threats that can cause catastrophes in the physical systems. Efficient network traffic anomaly detection is essential for guaranteeing the system's security and reliability. However, existing research on network traffic anomaly detection for ICPS has several limitations. First, most traffic anomaly detection models focus on centralized detection. Thus, all traffic packets have to be uploaded to the control center for detection, which leads to a heavy traffic load. However, real-time and reliable communication is crucial to ICPSs. The heavy traffic load may cause communication delays or packets lost by corruption. Second, Seasonal AutoRegressive Integrated Moving Average (SARIMA) is popular in ICPS network traffic anomaly detection. However, most SARIMA-based detection models can only detect anomalous traffic once. Thus, they are unable to detect anomalies continuously and are not suitable for actual ICPS. Third, the features extracted from network traffic affect the classification performance. However, most existing feature extraction models cannot sufficiently extract traffic features, leading to poor detection performance. To address the limitations above, this paper proposes a cloud-edge coordinated network traffic anomaly detection approach. The proposed approach consists of a set of anomalous traffic alarm models deployed in the edge areas and an anomalous traffic analysis model deployed in the cloud. The former is implemented based on Improved Online SARIMA (IOSARIMA) algorithm that can detect anomalous traffic continuously and upload it to the cloud for further analysis, filtering massive normal traffic packets and making traffic load smaller. The anomalous traffic analysis model consists of a feature extraction algorithm and a Convolutional Neural Network (CNN) classifier, which can sufficiently extract traffic features and identify the attack types precisely. The proposed anomaly detection approach is extensively evaluated on a realistic ICPS testbed, including 3 edges (i.e., power generation, power transmission and power distribution) and a cloud consisting of an engineering workstation and a Supervisory Control And Data Acquisition (SCADA) workstation. The experimental results confirm the smaller traffic load and better detection performance, compared with the existing detection models.

Coordinated Cloud-Edge Anomaly Identification for Active Distribution Networks

ADDP: Anomaly Detection for DTU Based on Power Consumption Side-Channel

Anomaly Identification for Active Distribution Networks Using Random Matrix Theory

Research on Situation Assessment of Active Distribution Networks Considering Cyberattacks

An Identification Method for Anomaly Types of Active Distribution Network Based on Data Mining

Operational Risk Evaluation of Active Distribution Networks Considering Cyber Contingencies

Distributed Attack Detection of Multi-area Power Systems Against False Data Injection Attacks

Situation Awareness of Active Distribution Network: Roadmap, Technologies, and Bottlenecks

Hybrid Cloud-Edge Collaborative Data Anomaly Detection in Industrial Sensor Networks

An Active Defense Mechanism for Cyber-Physical Power Systems Against Data Integrity Attack on ADMM-Based Economic Dispatch

Accurate Anomaly Detection with Energy-Efficiency in IoT-Edge-Cloud Collaborative Networks

Cloud-edge Coordinated Traffic Anomaly Detection for Industrial Cyber-Physical Systems

Edge-Cloud Collaborative Fault Detection for Distribution Networks Using Attention Mechanism

Distributed Anomaly Detection in Modern Power Systems: A Penalty-based Mitigation Approach

A Distributed Anomaly Detection Scheme Based on Correlation Awareness in WSN

Intelligent Anomaly Detection and Mitigation in Data Centers

A Multi-Agent Based Wide-Area Protection Scheme for Distributed Cyber Energy System

Deep-learning-assisted power loss management for active distribution networks

Correlation Anomaly Detection With Multiple Primary Attributes in Collaborative Device–Edge–Cloud Network

Adaptive Anomaly Detection for IoT Data in Hierarchical Edge Computing

Research on Fault Simulation of Active Distribution Network Based on Cyber Physical Combination