TY - GEN
T1 - Dynamic Adjusting ABC-SVM Anomaly Detection Based on Weighted Function Code Correlation
AU - Wan, Ming
AU - Li, Jinfang
AU - Luo, Hao
AU - Wang, Kai
AU - Wang, Yingjie
AU - Wang, Bailing
N1 - Publisher Copyright:
© 2020, Springer Nature Switzerland AG.
PY - 2020
Y1 - 2020
N2 - Under the tendency of interconnection and interoperability in Industrial Internet, anomaly detection, which has been widely recognized, has achieved modest accomplishments in industrial cyber security. However, a significant issue is how to effectively extract industrial control features which can accurately and comprehensively describe industrial control operations. Aiming at the function code field in industrial Modbus/TCP communication protocol, this paper proposes a novel feature extraction algorithm based on weighted function code correlation, which not only indicates the contribution of single function code in the whole function code sequence, but also analyzes the correlation of different function codes. In order to establish a serviceable detection engine, a dynamic adjusting ABC-SVM (Artificial Bee Colony - Support Vector Machine) anomaly detection model is also developed. The experimental results show that the proposed feature extraction algorithm can effectively reflect the changes of functional control behavior in process operations, and the improved ABC-SVM anomaly detection model can improve the detection ability by comparing with other anomaly detection engines.
AB - Under the tendency of interconnection and interoperability in Industrial Internet, anomaly detection, which has been widely recognized, has achieved modest accomplishments in industrial cyber security. However, a significant issue is how to effectively extract industrial control features which can accurately and comprehensively describe industrial control operations. Aiming at the function code field in industrial Modbus/TCP communication protocol, this paper proposes a novel feature extraction algorithm based on weighted function code correlation, which not only indicates the contribution of single function code in the whole function code sequence, but also analyzes the correlation of different function codes. In order to establish a serviceable detection engine, a dynamic adjusting ABC-SVM (Artificial Bee Colony - Support Vector Machine) anomaly detection model is also developed. The experimental results show that the proposed feature extraction algorithm can effectively reflect the changes of functional control behavior in process operations, and the improved ABC-SVM anomaly detection model can improve the detection ability by comparing with other anomaly detection engines.
KW - Anomaly detection
KW - Correlation analysis
KW - Dynamic adjusting ABC-SVM
KW - Function code weight
UR - https://www.scopus.com/pages/publications/85097162119
U2 - 10.1007/978-3-030-62223-7_1
DO - 10.1007/978-3-030-62223-7_1
M3 - 会议稿件
AN - SCOPUS:85097162119
SN - 9783030622220
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 1
EP - 11
BT - Machine Learning for Cyber Security - Third International Conference, ML4CS 2020, Proceedings
A2 - Chen, Xiaofeng
A2 - Yan, Hongyang
A2 - Yan, Qiben
A2 - Zhang, Xiangliang
PB - Springer Science and Business Media Deutschland GmbH
T2 - 3rd International Conference on Machine Learning for Cyber Security, ML4CS 2020
Y2 - 8 October 2020 through 10 October 2020
ER -