Temporal Phase Shifts in SCADA Networks
Temporal Phase Shifts in SCADA Networks
复制标题
SCADA 网络中的时间相移
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
A. Cárdenas
中科院分区：
文献类型：
--
作者：
Chen Markman;A. Wool;A. Cárdenas
在工业控制系统（ICS/SCADA）中，机器到机器的数据流量是高度周期性的。以前的工作表明，在许多情况下，可以在每个可编程逻辑控制器（PLC）和SCADA服务器之间创建基于自动机的流量模型，并使用该模型来检测流量中的异常。在测试以前模型的有效性时，我们注意到，总体而言，这些模型很难处理随时间变化的通信模式。在本文中，我们表明，在许多情况下，交通表现出阶段的时间，其中每个阶段有一个独特的模式，不同的阶段之间的过渡是相当尖锐的。我们提出了一种方法来自动检测交通相移，并提出了一个新的异常检测模型，结合多个阶段的交通。此外，我们提出了一种新的采样机制的训练集组装，这使得模型学习的所有阶段，在训练阶段以较低的复杂性。该模型具有类似的准确性和更少的宽容性相比，以前的一般确定性有限自动机（DFA）模型。此外，该模型可以为操作员提供有关在任何给定时间的受控过程的状态的信息，如在交通阶段中看到的。
In Industrial Control Systems (ICS/SCADA), machine to machine data traffic is highly periodic. Previous work showed that in many cases, it is possible to create an automata-based model of the traffic between each individual Programmable Logic Controller (PLC) and the SCADA server, and to use the model to detect anomalies in the traffic. When testing the validity of previous models, we noticed that overall, the models have difficulty in dealing with communication patterns that change over time. In this paper we show that in many cases the traffic exhibits phases in time, where each phase has a unique pattern, and the transition between the different phases is rather sharp. We suggest a method to automatically detect traffic phase shifts, and a new anomaly detection model that incorporates multiple phases of the traffic. Furthermore we present a new sampling mechanism for training set assembly, which enables the model to learn all phases during the training stage with lower complexity. The model presented has similar accuracy and much less permissiveness compared to the previous general Deterministic Finite Automata (DFA) model. Moreover, the model can provide the operator with information about the state of the controlled process at any given time, as seen in the traffic phases.