{"title":"检测对网络物理系统的隐蔽通道攻击","authors":"Hongwei Li, Danai Chasaki","doi":"10.1049/cps2.12078","DOIUrl":null,"url":null,"abstract":"<p>Cyberattacks on cyber-physical systems (CPS) have the potential to cause widespread disruption and affect the safety of millions of people. Machine learning can be an effective tool for detecting attacks on CPS, including the most stealthy types of attacks, known as covert channel attacks. In this study, the authors describe a novel hierarchical ensemble architecture for detecting covert channel attacks in CPS. Our proposed approach uses a combination of TCP payload entropy and network flows for feature engineering. Our approach achieves high detection performance, shortens the model training duration, and shows promise for effective detection of covert channel communications. This novel architecture closely mirrors the CPS attack stages in real-life, providing flexibility and adaptability in detecting new types of attacks.</p>","PeriodicalId":36881,"journal":{"name":"IET Cyber-Physical Systems: Theory and Applications","volume":null,"pages":null},"PeriodicalIF":1.7000,"publicationDate":"2023-09-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1049/cps2.12078","citationCount":"0","resultStr":"{\"title\":\"Detecting covert channel attacks on cyber-physical systems\",\"authors\":\"Hongwei Li, Danai Chasaki\",\"doi\":\"10.1049/cps2.12078\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"<p>Cyberattacks on cyber-physical systems (CPS) have the potential to cause widespread disruption and affect the safety of millions of people. Machine learning can be an effective tool for detecting attacks on CPS, including the most stealthy types of attacks, known as covert channel attacks. In this study, the authors describe a novel hierarchical ensemble architecture for detecting covert channel attacks in CPS. Our proposed approach uses a combination of TCP payload entropy and network flows for feature engineering. Our approach achieves high detection performance, shortens the model training duration, and shows promise for effective detection of covert channel communications. This novel architecture closely mirrors the CPS attack stages in real-life, providing flexibility and adaptability in detecting new types of attacks.</p>\",\"PeriodicalId\":36881,\"journal\":{\"name\":\"IET Cyber-Physical Systems: Theory and Applications\",\"volume\":null,\"pages\":null},\"PeriodicalIF\":1.7000,\"publicationDate\":\"2023-09-20\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"https://onlinelibrary.wiley.com/doi/epdf/10.1049/cps2.12078\",\"citationCount\":\"0\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"IET Cyber-Physical Systems: Theory and Applications\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://onlinelibrary.wiley.com/doi/10.1049/cps2.12078\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"Q3\",\"JCRName\":\"COMPUTER SCIENCE, INFORMATION SYSTEMS\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"IET Cyber-Physical Systems: Theory and Applications","FirstCategoryId":"1085","ListUrlMain":"https://onlinelibrary.wiley.com/doi/10.1049/cps2.12078","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q3","JCRName":"COMPUTER SCIENCE, INFORMATION SYSTEMS","Score":null,"Total":0}
Detecting covert channel attacks on cyber-physical systems
Cyberattacks on cyber-physical systems (CPS) have the potential to cause widespread disruption and affect the safety of millions of people. Machine learning can be an effective tool for detecting attacks on CPS, including the most stealthy types of attacks, known as covert channel attacks. In this study, the authors describe a novel hierarchical ensemble architecture for detecting covert channel attacks in CPS. Our proposed approach uses a combination of TCP payload entropy and network flows for feature engineering. Our approach achieves high detection performance, shortens the model training duration, and shows promise for effective detection of covert channel communications. This novel architecture closely mirrors the CPS attack stages in real-life, providing flexibility and adaptability in detecting new types of attacks.