Open Access iconOpen Access

ARTICLE

crossmark

RRCNN: Request Response-Based Convolutional Neural Network for ICS Network Traffic Anomaly Detection

Yan Du1,2, Shibin Zhang1,2,*, Guogen Wan1,2, Daohua Zhou3, Jiazhong Lu1,2, Yuanyuan Huang1,2, Xiaoman Cheng4, Yi Zhang4, Peilin He5

1 Country School of Cybersecurity, Chengdu University of Information Technology, Chengdu, 610225, China
2 Advanced Cryptography and System Security Key Laboratory of Sichuan Province, Chengdu, 610225, China
3 DAQSOFT CO., LTD, Chengdu, 610213, China
4 Communication and Information Technology Center, Petro China Southwest Oil and Gas Company, Chengdu, 610057, China
5 School of Computing and Information, University of Pittsburgh, Pittsburgh, 152607, PA, USA

* Corresponding Author: Shibin Zhang. Email: email

Computers, Materials & Continua 2023, 75(3), 5743-5759. https://doi.org/10.32604/cmc.2023.035919

Abstract

Nowadays, industrial control system (ICS) has begun to integrate with the Internet. While the Internet has brought convenience to ICS, it has also brought severe security concerns. Traditional ICS network traffic anomaly detection methods rely on statistical features manually extracted using the experience of network security experts. They are not aimed at the original network data, nor can they capture the potential characteristics of network packets. Therefore, the following improvements were made in this study: (1) A dataset that can be used to evaluate anomaly detection algorithms is produced, which provides raw network data. (2) A request response-based convolutional neural network named RRCNN is proposed, which can be used for anomaly detection of ICS network traffic. Instead of using statistical features manually extracted by security experts, this method uses the byte sequences of the original network packets directly, which can extract potential features of the network packets in greater depth. It regards the request packet and response packet in a session as a Request-Response Pair (RRP). The feature of RRP is extracted using a one-dimensional convolutional neural network, and then the RRP is judged to be normal or abnormal based on the extracted feature. Experimental results demonstrate that this model is better than several other machine learning and neural network models, with F1, accuracy, precision, and recall above 99%.

Keywords


Cite This Article

APA Style
Du, Y., Zhang, S., Wan, G., Zhou, D., Lu, J. et al. (2023). RRCNN: request response-based convolutional neural network for ICS network traffic anomaly detection. Computers, Materials & Continua, 75(3), 5743-5759. https://doi.org/10.32604/cmc.2023.035919
Vancouver Style
Du Y, Zhang S, Wan G, Zhou D, Lu J, Huang Y, et al. RRCNN: request response-based convolutional neural network for ICS network traffic anomaly detection. Comput Mater Contin. 2023;75(3):5743-5759 https://doi.org/10.32604/cmc.2023.035919
IEEE Style
Y. Du et al., "RRCNN: Request Response-Based Convolutional Neural Network for ICS Network Traffic Anomaly Detection," Comput. Mater. Contin., vol. 75, no. 3, pp. 5743-5759. 2023. https://doi.org/10.32604/cmc.2023.035919



cc This work is licensed under a Creative Commons Attribution 4.0 International License , which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
  • 811

    View

  • 393

    Download

  • 0

    Like

Share Link