A Two Stage Intrusion Detection System for Industrial Control Networks Based on Ethernet/IP

Abstract

Standard Ethernet (IEEE 802.3 and the TCP/IP protocol suite) is gradually applied in industrial control system (ICS) with the development of information technology. It breaks the natural isolation of ICS, but contains no security mechanisms. An improved intrusion detection system (IDS), which is strongly correlated to specific industrial scenarios, is necessary for modern ICS. On one hand, this paper outlines three kinds of attack models, including infiltration attacks, creative forging attacks, and false data injection attacks. On the other hand, a two stage IDS is proposed, which contains a traffic prediction model and an anomaly detection model. The traffic prediction model, which is based on the autoregressive integrated moving average (ARIMA), can forecast the traffic of the ICS network in the short term and detect infiltration attacks precisely according to the abnormal changes in traffic patterns. Furthermore, the anomaly detection model, using a one class support vector machine (OCSVM), is able to detect malicious control instructions by analyzing the key field in Ethernet/IP packets. The confusion matrix is selected to testify to the effectiveness of the proposed method, and two other innovative IDSs are used for comparison. The experiment results show that the proposed two stage IDS in this paper has an outstanding performance in detecting infiltration attacks, forging attacks, and false data injection attacks compared with other IDSs.

Advanced Cybersecurity Services Design

“…In [6] a spatiotemporal characterization of cyberattacks for detecting cyberattacks is proposed using a stochastic graph model to represent these cyberattacks in time and space. In [7], the area of industrial control networks is addressed with a two-stage intrusion detection system, including a traffic prediction model and an anomaly detection model. A chatbot is proposed in [8] for detecting online sex offenders, based on an Artificial Conversational Entity (ACE) that connects to different online chat services to start a conversation.…”

Research on abnormal network traffic detection method based on machine learning

“…The research status of abnormal traffic detection based on mathematical statistics is shown in literature [4]. The research status of abnormal traffic detection and detection model based on field protocol is as follows: Yu et al proposed to use ARIMA based traffic prediction model to predict short-term traffic, and single-class support vector machine to detect malicious instructions by analyzing key fields in Ethernet /IP packets [5].The basic idea of the abnormal traffic detection method based on machine learning is to take the network traffic data as the training set and use the machine learning algorithm to extract and train the data features. Ding Hongwei et al proposed an anomaly detection model by combining deep autocoding network and BP algorithm [6].The detection accuracy of this model is improved obviously.…”

“…Ding Hongwei et al proposed an anomaly detection model by combining deep autocoding network and BP algorithm [6].The detection accuracy of this model is improved obviously. Kuang proposed to improve the pooling method of convolutional neural network to dynamic adaptive pooling, and integrate it into the detection of abnormal network traffic [7].Eduardo et al proposed a network abnormal traffic detection method based on hybrid statistical technology and SOM [8].Kim et al proposed a network abnormal traffic detection method based on C-LSTM-DNN [9]. M Sheikhan et al proposed a network abnormal traffic detection method based on multi-layer perceptron (MLP) [10].…”

Bipolar fully recurrent deep structured neural learning based attack detection for securing industrial sensor networks

“…However, anomaly detection performance was not effectual. A two‐stage intrusion detection system was employed in Reference 13 for finding infiltration attacks, forging attacks, and false data injection attacks with higher accuracy. But intrusion detection accuracy was not improved.…”