Abstract:Several cases of Industrial Internet of Things (IIoT) attacks with zero-day vulnerabilities have been reported. To prevent these attacks, it is necessary to apply an abnormal behavior detection method; however, there are three main problems that make it hard. First, there are various industrial communication protocols. Instead of IT environments, many unstandardized protocols, which are usually defined by vendors, are used. Second, legacy devices are commonly used, not only EOS (End-of-service), but also EoL (End-of-Life). And last, the analysis of collected data is necessary for defining normal behavior. This behavior should be separately defined in each IIoT. Therefore, it is difficult to apply abnormal behavior detection in environments where economic and human investment is difficult. To solve these problems, we propose a deep learning based abnormal behavior detection technique that utilizes IIoT communication patterns. The proposed method uses a deep learning technique to train periodic data acquisition sequences, which is one of the common characteristics of IIoT. The trained model determined the sequence of packet is normal. The proposed technique can be applied without an additional analysis. The proposed method is expected to prevent security threats by proactively detecting cyberattacks. To verify the proposed method, a dataset was collected from the Korea Electric Power Control System. The model that defines normal behavior based on the application layer exhibits an accuracy of 79.6%. The other model, defining normal behavior based on the transport layer, has an accuracy of 80.9%. In these two models, most false positives and false negatives only occur when the abnormal packet is in a sequence.

Research on Deep Detection Technology of Abnormal Behavior of Power Industrial Control System

Real-time Monitoring of Smart Grid Terminals Based on Multi-dimensional Information Fusion

Cross-domain Anomaly Detection for Power Industrial Control System

Non-intrusive Runtime Monitoring for Power System Intelligent Terminal Based on Improved Deep Belief Networks (I-DBN)

Power IoT System Security Monitoring Based on Power Consumption Side Channel Information.

Research on Power Terminal Security Monitoring Method Based on Business Logic Consistency

Anomoly Detection for PLC Based on Magnetic Side Channel

Safety Monitoring of Power Industrial Control Terminals Based on Data Cleaning

Detecting Anomalies in Distributed Control Systems by Modeling Traffic Behaviors

Intrusion Detection Algorithm of Power Grid Industrial Control System Based on CNN

Using Power Side-Channel to Implement Anomaly-Based Intrusion Detection on Smart Grid Terminals

NIPAD: a Non-Invasive Power-Based Anomaly Detection Scheme for Programmable Logic Controllers

Two-Phase Industrial Control System Anomaly Detection Using Communication Patterns and Deep Learning

Research on Key Technologies of Power System Automation Application under Smart Grid

Analysis and Application of intelligent Power Control System Cyber Security Situation Awareness Based on Wavelet Neural Network

Features Extraction Based On Deep Analysis Of Network Packets In Industrial Control Systems

A Novel Approach for Traffic Anomaly Detection in Power Distributed Control System and Substation System.

Artificial Immune System Based Intrusion Detection In A Distributed Hierarchical Network Architecture Of Smart Grid

Distributed Intrusion Detection System in a Multi-Layer Network Architecture of Smart Grids

Tracking Real-time Anomalies in Cyber-Physical Systems Through Dynamic Behavioral Analysis

A Data-Driven Based Security Situational Awareness Framework for Power Systems