Abstract
AbstractUnder the tendency of interconnection and interoperability in Industrial Internet, anomaly detection, which has been widely recognized, has achieved modest accomplishments in industrial cyber security. However, a significant issue is how to effectively extract industrial control features which can accurately and comprehensively describe industrial control operations. Aiming at the function code field in industrial Modbus/TCP communication protocol, this paper proposes a novel feature extraction algorithm based on weighted function code correlation, which not only indicates the contribution of single function code in the whole function code sequence, but also analyzes the correlation of different function codes. In order to establish a serviceable detection engine, a dynamic adjusting ABC-SVM (Artificial Bee Colony - Support Vector Machine) anomaly detection model is also developed. The experimental results show that the proposed feature extraction algorithm can effectively reflect the changes of functional control behavior in process operations, and the improved ABC-SVM anomaly detection model can improve the detection ability by comparing with other anomaly detection engines.KeywordsAnomaly detectionFunction code weightCorrelation analysisDynamic adjusting ABC-SVM
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.