IDEAS home Printed from https://ideas.repec.org/a/gam/jeners/v15y2022i4p1517-d752466.html
   My bibliography  Save this article

Anomaly Detection in Cyclic Communication in OT Protocols

Author

Listed:
  • Milosz Smolarczyk

    (Research & Development Department, Cryptomage SA, 50-556 Wrocław, Poland)

  • Sebastian Plamowski

    (Institute of Control and Computation Engineering, Warsaw University of Technology, 00-661 Warsaw, Poland)

  • Jakub Pawluk

    (Research & Development Department, Cryptomage SA, 50-556 Wrocław, Poland)

  • Krzysztof Szczypiorski

    (Research & Development Department, Cryptomage SA, 50-556 Wrocław, Poland
    Institute of Telecommunications, Warsaw University of Technology, 00-661 Warsaw, Poland)

Abstract

This paper demonstrates the effectiveness of using anomaly detection in cyclic communication as a method aimed at protecting industrial installations from steganographic communication and a wide range of cyberattacks. The analysis was performed for a method based on deterministic finite automaton and the authors’ method using cycles. In this paper, we discuss the cycle detection algorithm and graph construction as well as demonstrate an anomaly detection method for cyberattack detection that utilizes stochastic elements, such as time-to-response and time-between-messages. We present a novel algorithm that combines finite automaton determinism modeling consecutive admissible messages with a time-domain model allowing for random deviations of regularity. The study was conducted for several test scenarios, including C&C steganographic channels generated using the Modbus TCP/IP protocol. Experimental results demonstrating the effectiveness of the algorithms are presented for both methods. All algorithms described in this paper are implemented and run as part of a passive warden system embedded in a bigger commercial IDS (intrusion detection system).

Suggested Citation

  • Milosz Smolarczyk & Sebastian Plamowski & Jakub Pawluk & Krzysztof Szczypiorski, 2022. "Anomaly Detection in Cyclic Communication in OT Protocols," Energies, MDPI, vol. 15(4), pages 1-20, February.
    • Handle: RePEc:gam:jeners:v:15:y:2022:i:4:p:1517-:d:752466
    as

    Download full text from publisher

    File URL: https://www.mdpi.com/1996-1073/15/4/1517/pdf
    Download Restriction: no
    File URL: https://www.mdpi.com/1996-1073/15/4/1517/
    Download Restriction: no
    ---><---

    References listed on IDEAS

    as
    1. DongHo Kang & ByoungKoo Kim & JungChan Na & KyoungSon Jhang, 2014. "Whitelists Based Multiple Filtering Techniques in SCADA Sensor Networks," Journal of Applied Mathematics, Hindawi, vol. 2014, pages 1-7, May.
    Full references (including those not matched with items on IDEAS)

    Citations

    Citations are extracted by the CitEc Project, subscribe to its RSS feed for this item.
    as


    Cited by:

    1. Wojciech Szczepanik & Marcin Niemiec, 2022. "Heuristic Intrusion Detection Based on Traffic Flow Statistical Analysis," Energies, MDPI, vol. 15(11), pages 1-19, May.
    2. Milosz Smolarczyk & Jakub Pawluk & Alicja Kotyla & Sebastian Plamowski & Katarzyna Kaminska & Krzysztof Szczypiorski, 2023. "Machine Learning Algorithms for Identifying Dependencies in OT Protocols," Energies, MDPI, vol. 16(10), pages 1-24, May.

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Bowen Xing & Yafeng Jiang & Yuqing Liu & Shouqi Cao, 2018. "Risk Data Analysis Based Anomaly Detection of Ship Information System," Energies, MDPI, vol. 11(12), pages 1-16, December.

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:gam:jeners:v:15:y:2022:i:4:p:1517-:d:752466. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: MDPI Indexing Manager (email available below). General contact details of provider: https://www.mdpi.com .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.