Time is of the Essence: Machine Learning-based Intrusion Detection in Industrial Time Series Data

Abstract

The Industrial Internet of Things drastically increases connectivity of devices in industrial applications. In addition to the benefits in efficiency, scalability and ease of use, this creates novel attack surfaces. Historically, industrial networks and protocols do not contain means of security, such as authentication and encryption, that are made necessary by this development. Thus, industrial IT-security is needed. In this work, emulated industrial network data is transformed into a time series and analysed with three different algorithms. The data contains labeled attacks, so the performance can be evaluated. Matrix Profiles perform well with almost no parameterisation needed. Seasonal Autoregressive Integrated Moving Average performs well in the presence of noise, requiring parameterisation effort. Long Short Term Memory-based neural networks perform mediocre while requiring a high training- and parameterisation effort.

arXiv commentExtended version of a publication in the 2018 IEEE International Conference on Data Mining Workshops (ICDMW)

References in corpus (5)

• Evaluation of Machine Learning-based Anomaly Detection Algorithms on an Industrial Modbus/TCP Data Set
• Multivariate Industrial Time Series with Cyber-Attack Simulation: Fault Detection Using an LSTM-based Predictive Data Model
• Two Decades of SCADA Exploitation: A Brief History
• A Question of Context: Enhancing Intrusion Detection by Providing Context Information
• Highly Scalable and Flexible Model for Effective Aggregation of Context-based Data in Generic IIoT Scenarios

Cited by in corpus (4)

• Using Temporal and Topological Features for Intrusion Detection in Operational Networks
• Modern Problems Require Modern Solutions: Hybrid Concepts for Industrial Intrusion Detection
• Creating it from SCRATCh: A Practical Approach for Enhancing the Security of IoT-Systems in a DevOps-enabled Software Development Environment
• Discussing the Feasibility of Acoustic Sensors for Side Channel-aided Industrial Intrusion Detection: An Essay