Learning Representations of Network Traffic Using Deep Neural Networks for Network Anomaly Detection: A Perspective towards Oil and Gas IT Infrastructures

Abstract

Oil and Gas organizations are dependent on their IT infrastructure, which is a small part of their industrial automation infrastructure, to function effectively. The oil and gas (O&G) organizations industrial automation infrastructure landscape is complex. To perform focused and effective studies, Industrial systems infrastructure is divided into functional levels by The Instrumentation, Systems and Automation Society (ISA) Standard ANSI/ISA-95:2005. This research focuses on the ISA-95:2005 level-4 IT infrastructure to address network anomaly detection problem for ensuring the security and reliability of Oil and Gas resource planning, process planning and operations management. Anomaly detectors try to recognize patterns of anomalous behaviors from network traffic and their performance is heavily dependent on extraction time and quality of network traffic features or representations used to train the detector. Creating efficient representations from large volumes of network traffic to develop anomaly detection models is a time and resource intensive task. In this study we propose, implement and evaluate use of Deep learning to learn effective Network data representations from raw network traffic to develop data driven anomaly detection systems. Proposed methodology provides an automated and cost effective replacement of feature extraction which is otherwise a time and resource intensive task for developing data driven anomaly detectors. The ISCX-2012 dataset is used to represent ISA-95 level-4 network traffic because the O&G network traffic at this level is not much different than normal internet traffic. We trained four representation learning models using popular deep neural network architectures to extract deep representations from ISCX 2012 traffic flows. A total of sixty anomaly detectors were trained by authors using twelve conventional Machine Learning algorithms to compare the performance of aforementioned deep representations with that of a human-engineered handcrafted network data representation. The comparisons were performed using well known model evaluation parameters. Results showed that deep representations are a promising feature in engineering replacement to develop anomaly detection models for IT infrastructure security. In our future research, we intend to investigate the effectiveness of deep representations, extracted using ISA-95:2005 Level 2-3 traffic comprising of SCADA systems, for anomaly detection in critical O&G systems.

Information Security Behavior and Information Security Policy Compliance: A Systematic Literature Review for Identifying the Transformation Process from Noncompliance to Compliance

“…Multiple researchers tried to solve the ISPC problem with technical controls, but technical solutions are not enough to solve behavioral information security problems. There must be administrative controls (i.e., security awareness via social techniques, top management support for enhancing social behaviors) to enhance ISP compliance [81].…”

iAceS-Deep: Sequence-Based Identification of Acetyl Serine Sites in Proteins Using PseAAC and Deep Neural Representations

“…This fact requires an efficient and accurate computational model to help researchers and biologists identifying these sites, easily. Modern deep learning offers a very powerful framework for solving learning problems [8]- [10]. When a Deep Neural Network (DNN) is sufficiently trained on input / output pairs of sequences, resultant output label is given by output layer of the model using classifiers such as logistic regression or softmax [11].…”

iNitroY-Deep: Computational Identification of Nitrotyrosine Sites to Supplement Carcinogenesis Studies Using Deep Learning

“…Deep learning is the study of different deep neural network architectures (DNNs) which have enabled many breakthroughs in different scientific disciplines including computer vision [35], natural language processing [36] and information security [37], [38] to mention a few. In essence, all DNNs consist of multiple layers of basic mathematical functions, dubbed as neurons, which transform the received inputs, layer by layer, until the transformed input reaches to the output layer of the neural network which uses this transformed input to make the predictions.…”