Operational Technology Network Anomaly Detection Using N-Grams
摘要
This paper proposes the use of n-grams to enhance anomaly detection in operational technology (OT) networks using byte-histograms. Byte histograms are highly effective at detecting anomalies but they often require domain-specific optimization techniques for reliable performance without an abundance of false alarms. The proposed technique does not require deep-packet inspection or protocol-specific information (beyond the physical and datalink layer), making the approach transferable and generalizable. Five different weighting schemes are used with similarity scores to fine tune n-gram evaluation and optimize anomaly detection. Furthermore, experimental results using an OT network traffic dataset show that it is possible to achieve good anomaly detection rates without any protocol-specific knowledge. Testing our generalized approach against this dataset shows an F1 score of 93.9% and an F2 score of 91.4%.