Přístupnostní navigace
E-přihláška
Vyhledávání Vyhledat Zavřít
Detail publikace
RYŠAVÝ, O. MATOUŠEK, P.
Originální název
A Network Traffic Processing Library for ICS Anomaly Detection
Typ
článek ve sborníku ve WoS nebo Scopus
Jazyk
angličtina
Originální abstrakt
Anomaly detection in industrial control systems based on traffic monitoring is one of the key components in securing these critical cyber-physical environments. Many anomaly detection methods have been proposed in the past decade. They are based on various principles stemming from signature detection, statistical analysis, or machine learning. Because of the lack of ICS communication datasets, their evaluation and mainly comparing their performance is problematic. If provided as a prototype implementation, the methods are implemented in various languages and require different input formats. In the present paper, we propose a library that can process ICS communication, extract required information, e.g., various packet-level or flow-level features, and provide the data to a user-specified anomaly detection method. It is possible to integrate the library in the system that automates the entire processing pipeline enabling us to conduct experiments with different methods while saving the time needed for manual data preparation. We also provide a preliminary performance evaluation of the library and demonstrate the system using two simple anomaly detection methods.
Klíčová slova
Anomaly Detection, Industrial Control Systems, Network Traffic Classification, Network Traffic Processing, Data Preparation Phase, Time Series Anomaly, ICS Anomaly Detection, Packet Traces
Autoři
RYŠAVÝ, O.; MATOUŠEK, P.
Vydáno
26. 5. 2021
Nakladatel
Association for Computing Machinery
Místo
Novi Sad
ISBN
978-1-4503-9057-6
Kniha
ECBS '21: Proceedings of the 7th Conference on the Engineering of Computer Based Systems
Strany od
144
Strany do
151
Strany počet
7
URL
https://www.fit.vut.cz/research/publication/12483/
BibTex
@inproceedings{BUT171483, author="Ondřej {Ryšavý} and Petr {Matoušek}", title="A Network Traffic Processing Library for ICS Anomaly Detection", booktitle="ECBS '21: Proceedings of the 7th Conference on the Engineering of Computer Based Systems", year="2021", pages="144--151", publisher="Association for Computing Machinery", address="Novi Sad", doi="10.1145/3459960.3459963", isbn="978-1-4503-9057-6", url="https://www.fit.vut.cz/research/publication/12483/" }