Abstract:This article presents a statistical approach using entropy and classification-based analysis to detect anomalies in industrial control systems traffic. Several statistical techniques have been proposed to create baselines and measure deviation to detect intrusion in enterprise networks with a centralized intrusion detection approach in mind. Looking at traffic volume alone to find anomalous deviation may not be enough—it may result in increased false positives. The near real-time communication requirements, coupled with the lack of centralized infrastructure in operations technology and limited resources of the sensor motes, require an efficient anomaly detection system characterized by these limitations. This paper presents extended results from our previous work by presenting a detailed cluster-based entropy analysis on selected network traffic features. It further extends the analysis using a classification-based approach. Our detailed entropy analysis corroborates with our earlier findings that, although some degree of anomaly may be detected using univariate and bivariate entropy analysis for Denial of Service (DOS) and Man-in-the-Middle (MITM) attacks, not much information may be obtained for the initial reconnaissance, thus preventing early stages of attack detection in the Cyber Kill Chain. Our classification-based analysis shows that, overall, the classification results of the DOS attacks were much higher than the MITM attacks using two Modbus features in addition to the three TCP/IP features. In terms of classifiers, J48 and random forest had the best classification results and can be considered comparable. For the DOS attack, no resampling with the 60–40 (training/testing split) had the best results (average accuracy of 97.87%), but for the MITM attack, the 80–20 non-attack vs. attack data with the 75–25 split (average accuracy of 82.81%) had the best results.

Anomaly-Based Detection of System-Level Threats and Statistical Analysis

Packet Payload Based Anomalous Network Intrusion Detection

Anomaly Detection for Modbus over TCP in Control Systems Using Entropy and Classification-Based Analysis

Universal Anomaly Detection: Algorithms and Applications

An overview of anomaly detection techniques: Existing solutions and latest technological trends

Statistical Techniques for Detecting Cyberattacks on Computer Networks Based on an Analysis of Abnormal Traffic Behavior

Anomaly-based network intrusion detection: Techniques, systems and challenges

Characterizing Network Anomaly Traffic with Euclidean Distance-Based Multiscale Fuzzy Entropy.

Network Traffic Decomposition for Anomaly Detection

An Approach for Anomaly Detection in Network Communications Using k-Path Analysis

Efficient Approach for Anomaly Detection in IoT Using System Calls

Anomaly Detections in Internet traffic Using Empirical Measures

Survey on Incremental Approaches for Network Anomaly Detection

Anomaly network traffic detection algorithm based on information entropy measurement under the cloud computing environment

Network Anomaly Detection: A Survey and Comparative Analysis of Stochastic and Deterministic Methods

A Rough Set Theory Based Method for Anomaly Intrusion Detection in Computer Network Systems

A Survey on Anomaly Based Host Intrusion Detection System

An Anomaly Detection and Analysis Method for Network Traffic Based on Correlation Coefficient Matrix.

Performance Analysis of Anomaly-Based Network Intrusion Detection Using Feature Selection and Machine Learning Techniques

Higher-Order Moment-Based Anomaly Detection

Real-time big data processing for anomaly detection: A Survey