Double Behavior Characteristics for One-Class Classification Anomaly Detection in Networked Control Systems

CORC > 沈阳自动化研究所 > 中国科学院沈阳自动化研究所 > 工业控制网络与系统研究室

	Double Behavior Characteristics for One-Class Classification Anomaly Detection in Networked Control Systems
	Shang WL(尚文利); Zeng P(曾鹏); Wan M(万明)
刊名	IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY
	2017
卷号	12 期号:12 页码:3011-3023
关键词	Function control behavior process data behavior one-class classification networked control systems
ISSN号	1556-6013
通讯作者	Shang WL(尚文利)
产权排序	1
中文摘要	Due to the growing dependencies of information network technology, networked control systems are undergoing a severe blow of cyberattacks, and simply modeling cyberattacks is inadequate and impractical for the detection requirements, because of various vulnerabilities in these systems and the diversities of cyberattacks. Actually, a feasible viewpoint is to identify misbehaviors by constructing a normal model of industrial communication behaviors. However, one of the chief difficulties is how to completely and appropriately summarize industrial communication behaviors according to the specific communication characteristics. In view of process control and data acquisition, this paper associates industrial communication characteristics with the time sequence, and further extracts two distinct behaviors: function control behavior and process data behavior. Based on these double behavior characteristics, we introduce one-class classification to detect the corresponding anomalies, respectively. Besides, we also present the weighted mixed Kernel function and parameter optimization method to improve classification performance. Experimental results clearly demonstrate that the proposed approach has significant advantages of classification accuracy and detection efficiency.
WOS标题词	Science & Technology ; Technology
类目[WOS]	Computer Science, Theory & Methods ; Engineering, Electrical & Electronic
研究领域[WOS]	Computer Science ; Engineering
关键词[WOS]	PRINCIPAL COMPONENT ANALYSIS ; INDUSTRIAL CONTROL-SYSTEM ; INTRUSION DETECTION ; SCADA SYSTEMS ; SUPPORT ; CHALLENGES ; AUTOMATION ; SECURITY ; KERNELS ; OCSVM
收录类别	SCI ; EI
语种	英语
WOS记录号	WOS:000409037000014
内容类型	期刊论文
源URL	[http://ir.sia.cn/handle/173321/21000]
专题	沈阳自动化研究所_工业控制网络与系统研究室
作者单位	Key Laboratory of Networked Control System, Chinese Academy of Sciences, Shenyang Institute of Automation, Shenyang 110016, China
推荐引用方式 GB/T 7714	Shang WL,Zeng P,Wan M. Double Behavior Characteristics for One-Class Classification Anomaly Detection in Networked Control Systems[J]. IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY,2017,12(12):3011-3023.
APA	Shang WL,Zeng P,&Wan M.(2017).Double Behavior Characteristics for One-Class Classification Anomaly Detection in Networked Control Systems.IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY,12(12),3011-3023.
MLA	Shang WL,et al."Double Behavior Characteristics for One-Class Classification Anomaly Detection in Networked Control Systems".IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 12.12(2017):3011-3023.