Publication Details

A Network Traffic Processing Library for ICS Anomaly Detection

RYŠAVÝ Ondřej and MATOUŠEK Petr. A Network Traffic Processing Library for ICS Anomaly Detection. In: ECBS '21: Proceedings of the 7th Conference on the Engineering of Computer Based Systems. Novi Sad: Association for Computing Machinery, 2021, pp. 144-151. ISBN 978-1-4503-9057-6.
Czech title
Knihovna zpracování síťového provozu pro detekci anomálií ICS
Type
conference paper
Language
english
Authors
Keywords

Anomaly Detection, Industrial Control Systems, Network Traffic Classification, Network Traffic Processing, Data Preparation Phase, Time Series Anomaly, ICS Anomaly Detection, Packet Traces

Abstract

Anomaly detection in industrial control systems based on traffic monitoring is one of the key components in securing these critical cyber-physical environments. Many anomaly detection methods have been proposed in the past decade. They are based on various principles stemming from signature detection, statistical analysis, or machine learning. Because of the lack of ICS communication datasets, their evaluation and mainly comparing their performance is problematic. If provided as a prototype implementation, the methods are implemented in various languages and require different input formats. In the present paper, we propose a library that can process ICS communication, extract required information, e.g., various packet-level or flow-level features, and provide the data to a user-specified anomaly detection method. It is possible to integrate the library in the system that automates the entire processing pipeline enabling us to conduct experiments with different methods while saving the time needed for manual data preparation. We also provide a preliminary performance evaluation of the library and demonstrate the system using two simple anomaly detection methods.

Published
2021
Pages
144-151
Proceedings
ECBS '21: Proceedings of the 7th Conference on the Engineering of Computer Based Systems
Conference
7th Conference on the Engineering of Computer Based Systems, Novi Sad, RS
ISBN
978-1-4503-9057-6
Publisher
Association for Computing Machinery
Place
Novi Sad, RS
DOI
EID Scopus
BibTeX
@INPROCEEDINGS{FITPUB12483,
   author = "Ond\v{r}ej Ry\v{s}av\'{y} and Petr Matou\v{s}ek",
   title = "A Network Traffic Processing Library for ICS Anomaly Detection",
   pages = "144--151",
   booktitle = "ECBS '21: Proceedings of the 7th Conference on the Engineering of Computer Based Systems",
   year = 2021,
   location = "Novi Sad, RS",
   publisher = "Association for Computing Machinery",
   ISBN = "978-1-4503-9057-6",
   doi = "10.1145/3459960.3459963",
   language = "english",
   url = "https://www.fit.vut.cz/research/publication/12483"
}
Back to top