Jianming Zhao

The device anomaly detection in an industrial control system (ICS) is essential for identifying devices with abnormal operating states or unauthorized access, aiming to protect the ICS from unauthorized access, malware, operational errors, and hardware failures. This paper addresses the issues of numerous manufacturers, complex models, and incomplete information by proposing a fingerprint extraction method based on ICS protocol communication models, applied to an anomaly detection model fine-tuned using the Llama3 model. By considering both hardware and software characteristics of ICS devices, the paper designs a fingerprint vector that can be extracted in both active and passive network communication environments. Experimental data include real ICS network traffic from an oilfield station and extensive ICS device traffic data obtained through network scanning tools. The results demonstrate that the proposed method outperforms existing methods in terms of accuracy and applicability, especially in differentiating devices from various manufacturers and models, significantly enhancing anomaly detection performance. The innovation lies in using large language models for feature extraction and the anomaly detection of device fingerprints, eliminating dependency on specific ICS scenarios and protocols while substantially improving detection accuracy and applicability.

As the precursor of cyber-attacks, the campaigns of scanning groups are able to reflect the attack target and attack trend to a great extent, which provide highly valuable threat intelligence for cyber defenders to understand the current cyber security situation. However, how to identify scanning groups in the context of limited information, especially in the absence of relevant threat intelligence, remains a challenging problem. In this paper, we utilize the honeynet as the unique data source to propose a scanning group identification system, Scanner-Hunter, which focuses on identifying scanning groups targeting ICS devices. To better characterize scanning patterns, a novel traffic representation scheme for scanning traffic is proposed, which is composed of a set of feature vectors to describe all the ICS request packets. On this basis, we propose a novel self-expanding multi-class classification (SEMCC) model and the IP prefix judgment, which are deliberately integrated to cope with sophisticated scanning groups. Take the Modbus protocol as an example, we implement a prototype of Scanner-Hunter, and use six years of real-world honeynet datasets to evaluate its performance. The experimental results illustrate its effectiveness and superior performance compared with some popular machine learning methods and existing SOTA scanning group identification methods. In addition, Scanner-Hunter is further leveraged to investigate the group distribution and maliciousness of 506 unknown scanners, and some suspicious attack groups with APT characteristics are analyzed. Furthermore, accurate scanning group information will contribute to revealing potential attack organizations and supporting decision making to prevent or interrupt cyber-attacks in time.

This article addresses the challenge of optimizing performance in a fragmentation blockchain system for industrial Internet of things (IIOT) applications. It introduces an enhanced version of the traditional Whale Optimization Algorithm (WOA) known as the Chaotic Whale Optimization Algorithm. This enhanced algorithm is designed to optimize the parameters of the fragmentation blockchain system with the goal of maximizing real-time memory utilization in the fragmentation nodes while minimizing block consensus time. The proposed method identifies optimal blockchain system parameters within diverse network environments, taking into account factors such as node computing power and inter-node transmission rates. To mitigate the issue of local optima inherent in traditional algorithms, the Chaotic Whale Optimization Algorithm transforms the optimization problem in a more intuitive manner. This algorithm strikes a fine balance between diversity and convergence. The effectiveness of this method is assessed through simulation experiments, with results indicating its superior performance compared to alternative approaches. Overall, the approach presented in this article significantly reduces consensus time within the fragmentation blockchain system and enhances real-time memory utilization in the fragmented blocks.

Feature extraction plays an important role in constructing artificial intelligence (AI) models of industrial control systems (ICSs). Three challenges in this field are learning effective representation from high-dimensional features, data heterogeneity, and data noise due to the diversity of data dimensions, formats and noise of sensors, controllers and actuators. Hence, a novel unsupervised learning autoencoder model is proposed for ICS data in this paper. Although traditional methods only capture the linear correlations of ICS features, our deep industrial representation learning model (DIRL) based on a convolutional neural network can mine high-order features, thus solving the problem of high-dimensional and heterogeneous ICS data. In addition, an unsupervised denoising autoencoder is introduced for noisy ICS data in DIRL. Training the denoising autoencoder allows the model to better mitigate the sensor noise problem. In this way, the representative features learned by DIRL could help to evaluate the safety state of ICSs more effectively. We tested our model with absolute and relative accuracy experiments on two large-scale ICS datasets. Compared with other popular methods, DIRL showed advantages in four common indicators of AI algorithms: accuracy, precision, recall, and F1-score. This study contributes to the effective analysis of large-scale ICS data, which promotes the stable operation of ICSs.

Due to the rapid development of industrial automation, ICSs (Industrial Control Systems) gradually expose their potential security vulnerabilities, and are facing more and more serious security risks. Although different industrial security technologies have been developed to strengthen industrial security protection, they always struggle for their own because of their standalone and non-related functions, and their actual defense effects are not encouraging. This paper first summarizes some intrinsic security vulnerabilities in ICSs, and analyzes the main causes to generate each class of vulnerabilities. Furthermore, five popular security technologies which have been successfully applied in today's ICSs are introduced, and their advantages and shortages are also compared by explaining each working mechanism. In order to take full advantage of various industrial security technologies, this paper proposes one novel cooperative defense model based P2DR (Policy, Protection, Detection and Response), which establishes the dynamical defense process to integrate five different industrial security technologies. Under the guidance of security policies, this model can comprehensively utilize the resources of various industrial security technologies to learn and judge current security status of the whole system, and effectively adjust the optimum deployment to provide the strongest protection with the lowest risk. Finally, one applicable case based on the proposed model is designed to verify the feasibility of cooperative defense in ICSs.

At present, the information technology of industrial automation control system is developing rapidly, and the system information security is facing severe challenges. Accurate and efficient risk assessment of industrial control systems is conducive to their protection and efficient production. Although there have been quite a few studies on the risk assessment of industrial control systems, there is less consideration of the interaction between the equipment in the system at present. In view of this, this paper proposes an information security risk assessment method based on the impact of neighborhood integration, which can fully consider the changes of equipment functions within the damaged range of industrial control systems. The experimental results in some model systems reveal that the algorithm in this paper can evaluate the information security risks of industrial control systems more accurately, and provides a theoretical method for the stable operation of industrial systems.

Industrial network systems are facing various new challenges, such as increasing functional failure factors, the accelerating penetration of information threats, and complex and diverse attack methods. Industrial networks are often vulnerable to natural or intentional disasters; therefore, it is highly invaluable to research to identify the influential nodes. Most of the state-of-the-art evaluates the importance of the nodes according to one or more network metrics. Moreover, there are no metrics reflecting all the properties of the network. In this paper, a novel method (Structure-based Identification Method, SIM) to identify the influential nodes in industrial networks is proposed based on the network structure, which goes beyond the use of network metrics. The SIM method extracts the weakly connected components, which are more likely to survive after the important nodes are attacked in the network. Evaluation results show that the SIM method obtains better results than the state-of-the-art methods to identify influential nodes in real-world industrial networks and has a good prospect to be applied in industrial application.

Mobile video communication and Internet of Things are playing a more and more important role in our daily life. Mobile Edge Computing (MEC), as the essential network architecture for the Internet, can significantly improve the quality of video streaming applications. The mobile devices transferring video flow are often exposed to hostile environment, where they would be damaged by different attackers. Accordingly, Mobile Edge Computing Network is often vulnerable under disruptions, against either natural disasters or human intentional attacks. Therefore, research on secure hub location in MEC, which could obviously enhance the robustness of the network, is highly invaluable. At present, most of the attacks encountered by edge nodes in MEC in the IoT are random attacks or random failures. According to network science, scale-free networks are more robust than the other types of network under the random failures. In this paper, an optimization algorithm is proposed to reorganize the structure of the network according to the amount of information transmitted between edge nodes. BA networks are more robust under random attacks, while WS networks behave better under human intentional attacks. Therefore, we change the structure of the network accordingly, when the attack type is different. Besides, in the MEC networks for mobile video communication, the capacity of each device and the size of the video data influence the structure significantly. The algorithm sufficiently takes the capability of edge nodes and the amount of the information between them into consideration. In robustness test, we set the number of network nodes to be 200 and 500 and increase the attack scale from 0 to 100 to observe the behaviours of the size of the giant component and the robustness calculated for each attack method. Evaluation results show that the proposed algorithm can significantly improve the robustness of the MEC networks and has good potential to be applied in real-world MEC systems.

IIoT (Industrial Internet of Things) has gained considerable attention and has been increasingly applied due to its ubiquitous sensing and communication. However, the sparse characteristic of sensing data in distributed IIoT networks may bring out tremendous challenges to implement the security protection measures. Based on the design of centralized data gathering and forwarding, this paper proposes a novel anomaly detection approach for IIoT sparse data, which can successfully collaborate the adaptive CEEMDAN (Complete Ensemble Empirical Mode Decomposition with Adaptive Noise) feature exploitation with one intelligent optimizing classification. Furthermore, in the adaptive CEEMDAN feature exploitation, the CEEMDAN energy entropy based on adaptive IMF (Intrinsic Mode Function) selection is designed to extract the sensing features from IIoT sparse data; in the intelligent optimizing classification, one effective OCSVM (One‐Class Support Vector Machine) classifier optimized by the IABC (Improved Artificial Bee Colony) swarm intelligence algorithm is introduced to detect various abnormal sensing features. The experimental results show that, not only does the CEEMDAN energy entropy based on adaptive IMF selection accurately describe the change of industrial production by analyzing the probability distribution and energy distribution of sparse sensing data, but also the proposed IABC‐OCSVM classifier has higher detection efficiency compared with the OCSVM classifiers optimized by other swarm intelligence algorithms.