Detecting covert channel attacks on cyber‐physical systems
-
Published:2023-09-20
Issue:
Volume:
Page:
-
ISSN:2398-3396
-
Container-title:IET Cyber-Physical Systems: Theory & Applications
-
language:en
-
Short-container-title:IET Cyber-Phy Sys Theory & Ap
Author:
Li Hongwei1,
Chasaki Danai1ORCID
Affiliation:
1. Department of Electrical and Computer Engineering Villanova University Villanova Pennsylvania USA
Abstract
AbstractCyberattacks on cyber‐physical systems (CPS) have the potential to cause widespread disruption and affect the safety of millions of people. Machine learning can be an effective tool for detecting attacks on CPS, including the most stealthy types of attacks, known as covert channel attacks. In this study, the authors describe a novel hierarchical ensemble architecture for detecting covert channel attacks in CPS. Our proposed approach uses a combination of TCP payload entropy and network flows for feature engineering. Our approach achieves high detection performance, shortens the model training duration, and shows promise for effective detection of covert channel communications. This novel architecture closely mirrors the CPS attack stages in real‐life, providing flexibility and adaptability in detecting new types of attacks.
Publisher
Institution of Engineering and Technology (IET)
Subject
Artificial Intelligence,Electrical and Electronic Engineering,Computer Networks and Communications,Computer Science Applications,Information Systems
Reference42 articles.
1. Cybersecurityś pearl harbor moment: lessons learned from the colonial pipeline ransomware attack;Reeder J.R.;The Cyber Defense Review,2021
2. Miller S. et al.:TRITON Actor TTP Profile Custom Attack Tools Detections and ATT&CK Mapping(2019). [Online].https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-p%20rofile-custom-attack-tools-detections.html