Analysis of Machine Learning Methods in EtherCAT-Based Anomaly Detection

Abstract

Today, the use of Ethernet-based protocols in industrial control systems (ICS) communications has led to the emergence of attacks based on information technology (IT) on supervisory control and data acquisition systems. In addition, the familiarity of Ethernet and TCP/IP protocols and the diversity and success of attacks on them raises security risks and cyber threats for ICS. This issue is compounded by the absence of encryption, authorization, and authentication mechanisms due to the development of industrial communications protocols only for performance purposes. Recent zero-day attacks, such as Triton, Stuxnet, Havex, Dragonfly, and Blackenergy, as well as the Ukraine cyber-attack, are possible because of the vulnerabilities of the systems; these attacksare carried by the protocols used in communication between PLC and I/O units or HMI and engineering stations. It is evident that there is a need for robust solutions that detect and prevent protocol-based cyber threats. In this paper, machine learning methods are evaluated for anomaly detection, particularly for EtherCAT-based ICS. To the best of the author's knowledge, there has been no research focusing on machine learning algorithms for anomaly detection of EtherCAT. Before testing anomaly detection, an EtherCAT-based water level control system testbed was developed. Then, a total of 16 events were generated in four categories and applied on the testbed. The dataset created was used for anomaly detection. The results showed that the k-nearest neighbors (k-NN) and support vector machine with genetic algorithm (SVM GA) models perform best among the 18 techniques applied. In addition to detecting anomalies, the methods are able to flag the attack types better than other techniques and are applicable in EtherCAT networks. Also, the dataset and events can be used for further studies since it is difficult to obtain data for ICS due to its critical infrastructure and continuous real-time operation.INDEX TERMS Anomaly detection, EtherCAT security, ICS security, machine learning for EtherCAT.

Communications Security in Industry X: A Survey

“…It is capable of addressing specific concerns in industries such as rapid response times, minimal data requirement for the devices engaged in communication, and efficient cost of implementation. With EtherCAT, the master sends data possibly only a single frame for the entire node network that will pass through each node [364]. However, the EtherCAT protocol lacks connectionbased security and flow issues for recognizing the masters and slaves in the network.…”

An optimization technique for intrusion detection of industrial control network vulnerabilities based on BP neural network

“…In addition, 4000 of them as test data sets contain 3987 normal data and 13 abnormal data. Now the proposed algorithm and the traditional BP algorithm are tested and compared by using the data collected by the industrial control system [23] . Due to the large normal database in the normal operation of the industrial control network, the false positive rate is not compared here.…”

Research on a PSO-H-SVM-Based Intrusion Detection Method for Industrial Robotic Arms

“…Akpinar et al [35] proposed a learning-based intrusion detection method for the EtherCAT protocol, where an attack vector is created based on real-time data and a support vector machine training model is used to perform anomaly detection, which is used to detect anomalies in the communication protocol. In [36], the authors further classified the protocols into four categories by classifying the various features of the protocols. They produced 16 events in the 4 categories for anomaly detection, and the genetic algorithm-based support vector (GA-SVM) machine demonstrated good detection results.…”