This paper proposes the use of n-grams to enhance anomaly detection in operational technology (OT) networks using byte-histograms. Byte histograms are highly effective at detecting anomalies but they often require domain-specific optimization techniques for reliable performance without an abundance of false alarms. The proposed technique does not require deep-packet inspection or protocol-specific information (beyond the physical and datalink layer), making the approach transferable and generalizable. Five different weighting schemes are used with similarity scores to fine tune n-gram evaluation and optimize anomaly detection. Furthermore, experimental results using an OT network traffic dataset show that it is possible to achieve good anomaly detection rates without any protocol-specific knowledge. Testing our generalized approach against this dataset shows an F1 score of 93.9% and an F2 score of 91.4%.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Operational Technology Network Anomaly Detection Using N-Grams

  • Jack Nunnelee,
  • Alex Howe,
  • Mauricio Papa

摘要

This paper proposes the use of n-grams to enhance anomaly detection in operational technology (OT) networks using byte-histograms. Byte histograms are highly effective at detecting anomalies but they often require domain-specific optimization techniques for reliable performance without an abundance of false alarms. The proposed technique does not require deep-packet inspection or protocol-specific information (beyond the physical and datalink layer), making the approach transferable and generalizable. Five different weighting schemes are used with similarity scores to fine tune n-gram evaluation and optimize anomaly detection. Furthermore, experimental results using an OT network traffic dataset show that it is possible to achieve good anomaly detection rates without any protocol-specific knowledge. Testing our generalized approach against this dataset shows an F1 score of 93.9% and an F2 score of 91.4%.