Clustering of Distributed Observations for Traffic Classification in Industrial Networks
Emiliano Sisinni, Dennis Brandão, Alessandra Flammini, Massimiliano Gaffurini, Paolo Ferrari · 2025
Respecting real-time requirements in networked control systems requires that the network traffic respects some well-defined constraints. Any abnormal behavior, e.g. due to malfunctioning of few devices or representing a malicious attack, could disrupt the overall plant behavior. Immediate recognition of anomalies should occur, to determine the causes and mitigate the impairments. Despite hardware sniffer being ready available, deployment cost, maintenance cost and topology constrains of industrial network discourage their adoption for live traffic collection. Additionally, anomaly detection systems are typically complex solutions that demand experienced personnel, which is not generally available among plant maintenance workers. This paper presents the ongoing research activity for a simple but effective expert system that gathers network-related figure of merits natively evaluated by industrial-grade devices, acquired by standard SNMP (Simple Network Management Protocol) queries. Data collected by such a distributed measurement system are further analyzed using simple classification techniques, as the unsupervised clustering, which limit the computational burden. In this work some suitable performance indicators are addressed and the related multi dimensional clustering is discussed. Some preliminary results are provided, exploiting a reference use case designed around a real-world assembly machine.