2018/08/15 by Chen Markman, Markman, Chen, Avishai Wool +4
Computer Science · Engineering · #Advanced Malware Detection Techniques #Anomaly detection #Artificial intelligence #Automaton #Computer science #Control (management) #Controller (irrigation) #Cryptography and Security (cs.CR) #Data mining #Distributed computing #Engineering #FOS: Computer and information sciences #Industrial control system #Network Security and Intrusion Detection #Process (computing) #Programmable logic controller #Real-time computing #SCADA #Set (abstract data type) #Smart Grid Security and Resilience #cs.CR
paper · pdf · doi:10.48550/arxiv.1808.05068
Full version of CPS-SPC'18 short paper
arxiv created 2018/08/15 · openalex publication_date 2018/08/15 · arxiv updated 2018/08/16 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/06
In Industrial Control Systems (ICS/SCADA), machine to machine data traffic is highly periodic. Previous work showed that in many cases, it is possible to create an automata-based model of the traffic between each individual Programmable Logic Controller (PLC) and the SCADA server, and to use the model to detect anomalies in the traffic. When testing the validity of previous models, we noticed that overall, the models have difficulty in dealing with communication patterns that change over time. In this paper we show that in many cases the traffic exhibits phases in time, where each phase has a unique pattern, and the transition between the different phases is rather sharp. We suggest a method to automatically detect traffic phase shifts, and a new anomaly detection model that incorporates multiple phases of the traffic. Furthermore we present a new sampling mechanism for training set assembly, which enables the model to learn all phases during the training stage with lower complexity. The model presented has similar accuracy and much less permissiveness compared to the previous general DFA model. Moreover, the model can provide the operator with information about the state of the controlled process at any given time, as seen in the traffic phases.