Industrial network anomaly behavior detection via exponential smoothing model
Evgeny V. Andryukhin, Aleksandr N. Veligura · 2018
There are a lot of network monitors which are capable of performing network packets deep inspection (DPI) as a set of information security check. These steps include intrusion detection system check, exfiltration, detection and parental filtering. However, it is not allowed to use such a slow mechanism as DPI in industrial networks. Hence, architectors have to choose only one of two capabilities of the system: system is required to be fast and fail safe even without any protection mechanisms such as encryption and/or signatures. The proposed approach describes a model of abnormal activity detection, which uses two algorithms to work with industrial network traffic: one is based on Brown's adaptive prediction model and another one based on Support Vector Machine (SVM) predict method. Not typical events detection is demonstrated on test traffic captures.