Abstract:Industrial cyber-physical systems (ICPSs) are facing increasing cyber threats that can cause catastrophes in the physical systems. Efficient network traffic anomaly detection is essential for guaranteeing the system's security and reliability. However, existing research on network traffic anomaly detection for ICPS has several limitations. First, most traffic anomaly detection models focus on centralized detection. Thus, all traffic packets have to be uploaded to the control center for detection, which leads to a heavy traffic load. However, real-time and reliable communication is crucial to ICPSs. The heavy traffic load may cause communication delays or packets lost by corruption. Second, Seasonal AutoRegressive Integrated Moving Average (SARIMA) is popular in ICPS network traffic anomaly detection. However, most SARIMA-based detection models can only detect anomalous traffic once. Thus, they are unable to detect anomalies continuously and are not suitable for actual ICPS. Third, the features extracted from network traffic affect the classification performance. However, most existing feature extraction models cannot sufficiently extract traffic features, leading to poor detection performance. To address the limitations above, this paper proposes a cloud-edge coordinated network traffic anomaly detection approach. The proposed approach consists of a set of anomalous traffic alarm models deployed in the edge areas and an anomalous traffic analysis model deployed in the cloud. The former is implemented based on Improved Online SARIMA (IOSARIMA) algorithm that can detect anomalous traffic continuously and upload it to the cloud for further analysis, filtering massive normal traffic packets and making traffic load smaller. The anomalous traffic analysis model consists of a feature extraction algorithm and a Convolutional Neural Network (CNN) classifier, which can sufficiently extract traffic features and identify the attack types precisely. The proposed anomaly detection approach is extensively evaluated on a realistic ICPS testbed, including 3 edges (i.e., power generation, power transmission and power distribution) and a cloud consisting of an engineering workstation and a Supervisory Control And Data Acquisition (SCADA) workstation. The experimental results confirm the smaller traffic load and better detection performance, compared with the existing detection models.

CP Fusion based Abnormal Traffic Dedection for Process Layer Network in Digital Substation

Real-time Monitoring of Smart Grid Terminals Based on Multi-dimensional Information Fusion

Abnormal Message Logic & Sequence Detection for Process Layer Network in Digital Substation

FARIMA Model-Based Communication Traffic Anomaly Detection in Intelligent Electric Power Substations

Multi-Scale Traffic Aware Cybersecurity Situational Awareness Online Model for Intelligent Power Substation Communication Network

Intrusion Detection Method Based on the Legality of Action Messages in Process Layer of Smart Substation

Digital Substation Cyber Security Analysis with Syn-Flood Attack As A Simulation Case

Message Flow Modeling Analysis and Application for Digital Substation Process Layer Network

FARIMA Model Based Analysis of Communication Traffic Anomaly in Smart Substation

Assessment and Quantify the Impact of Different Data Flow Control Methods on Digital Substation Communication Network

Cloud-edge Coordinated Traffic Anomaly Detection for Industrial Cyber-Physical Systems

A packet payload anomaly detection approach for cyber-physical power systems

Application-Layer Anomaly Detection Leveraging Time-Series Physical Semantics in CAN-FD Vehicle Networks

Novel Approach of Fault Diagnosis in Power Grid Using Information Fusion

Research on the detection of abnormal traffic for multi-channel network

OPNET Based Simulation Modeling and Analysis of DoS Attack for Digital Substation

A Novel Approach for Traffic Anomaly Detection in Power Distributed Control System and Substation System.

Tracking Real-time Anomalies in Cyber-Physical Systems Through Dynamic Behavioral Analysis

An On-line Intelligent Alarm Processing System for Digital Substations

Intelligent alarm processing and fault diagnosis in digital substations

CPMTD: Cyber-physical moving target defense for hardening the security of power system against false data injected attack