Anomaly Detection in Cyclic Communication in OT Protocols

Milosz Smolarczyk, Sebastian Plamowski, Jakub Pawluk and Krzysztof Szczypiorski
Additional contact information
Milosz Smolarczyk: Research & Development Department, Cryptomage SA, 50-556 Wrocław, Poland
Sebastian Plamowski: Institute of Control and Computation Engineering, Warsaw University of Technology, 00-661 Warsaw, Poland
Jakub Pawluk: Research & Development Department, Cryptomage SA, 50-556 Wrocław, Poland
Krzysztof Szczypiorski: Research & Development Department, Cryptomage SA, 50-556 Wrocław, Poland

Energies, 2022, vol. 15, issue 4, 1-20

Abstract: This paper demonstrates the effectiveness of using anomaly detection in cyclic communication as a method aimed at protecting industrial installations from steganographic communication and a wide range of cyberattacks. The analysis was performed for a method based on deterministic finite automaton and the authors’ method using cycles. In this paper, we discuss the cycle detection algorithm and graph construction as well as demonstrate an anomaly detection method for cyberattack detection that utilizes stochastic elements, such as time-to-response and time-between-messages. We present a novel algorithm that combines finite automaton determinism modeling consecutive admissible messages with a time-domain model allowing for random deviations of regularity. The study was conducted for several test scenarios, including C&C steganographic channels generated using the Modbus TCP/IP protocol. Experimental results demonstrating the effectiveness of the algorithms are presented for both methods. All algorithms described in this paper are implemented and run as part of a passive warden system embedded in a bigger commercial IDS (intrusion detection system).

Keywords: cybersecurity; steganography; cyclic communication; Modbus TCP/IP; deterministic finite automaton (search for similar items in EconPapers)
JEL-codes: Q Q0 Q4 Q40 Q41 Q42 Q43 Q47 Q48 Q49 (search for similar items in EconPapers)
Date: 2022
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (2)

Downloads: (external link)
https://www.mdpi.com/1996-1073/15/4/1517/pdf (application/pdf)
https://www.mdpi.com/1996-1073/15/4/1517/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jeners:v:15:y:2022:i:4:p:1517-:d:752466

Access Statistics for this article

Energies is currently edited by Ms. Agatha Cao

More articles in Energies from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().