Dynamic Adjusting ABC-SVM Anomaly Detection Based on Weighted Function Code Correlation.

Under the tendency of interconnection and interoperability in Industrial Internet, anomaly detection, which has been widely recognized, has achieved modest accomplishments in industrial cyber security. However, a significant issue is how to effectively extract industrial control features which can accurately and comprehensively describe industrial control operations. Aiming at the function code field in industrial Modbus/TCP communication protocol, this paper proposes a novel feature extraction algorithm based on weighted function code correlation, which not only indicates the contribution of single function code in the whole function code sequence, but also analyzes the correlation of different function codes. In order to establish a serviceable detection engine, a dynamic adjusting ABC-SVM (Artificial Bee Colony - Support Vector Machine) anomaly detection model is also developed. The experimental results show that the proposed feature extraction algorithm can effectively reflect the changes of functional control behavior in process operations, and the improved ABC-SVM anomaly detection model can improve the detection ability by comparing with other anomaly detection engines.