Publication Details
Anomaly Detection of ICS Communication Using Statistical Models
anomaly detection, communication patterns, industrial networks, IEC 104,
monitoring, smart grid
Industrial Control System (ICS) transmits control and monitoring data between
devices in an industrial environment that includes smart grids, water and gas
distribution, or traffic control. Unlike traditional internet communication, ICS
traffic is stable, periodical, and with regular communication patterns that can
be described using statistical modeling. By observing selected features of ICS
transmission, e.g., packet direction and inter-arrival times, we can create
a statistical profile of the communication based on distribution of features
learned from the normal ICS traffic. This paper demonstrates that using
statistical modeling, we can detect various anomalies caused by irregular
transmissions, device or link failures, and also cyber attacks like packet
injection, scanning, or denial of service (DoS). The paper shows how
a statistical model is automatically created from a training dataset. We present
two types of statistical profiles: the master-oriented profile for one-to-many
communication and the peer-to-peer profile that describes traffic between two ICS
devices. The proposed approach is fast and easy to implement as a part of an
intrusion detection system (IDS) or an anomaly detection (AD) module. The
proof-of-concept is demonstrated on two industrial protocols: IEC 60870-5-104
(aka IEC 104) and IEC 61850 (Goose).
@inproceedings{BUT175786,
author="Ivana {Burgetová} and Petr {Matoušek} and Ondřej {Ryšavý}",
title="Anomaly Detection of ICS Communication Using Statistical Models",
booktitle="Proceedings of the 17th International Conference on Network Service Management (CNSM 2021)",
year="2021",
pages="166--172",
publisher="Institute of Electrical and Electronics Engineers",
address="Izmir",
doi="10.23919/CNSM52442.2021.9615510",
isbn="978-3-903176-36-2",
url="https://ieeexplore.ieee.org/abstract/document/9615510"
}