Sequence-Based Anomaly Detection in Critical Infrastructure Networks

Conference · Wed Aug 07 00:00:00 EDT 2024

OSTI ID:3023455

Devaney, Garrett ^[1]; Quach, Anna ^[2]; Rogers, Dempsey D ^[2]; Katopodis, Alex ^[3]; Thiagarajan, Alaguvalliappan ^[4]

---

1. Georgia Tech
2. Idaho National Laboratory
3. Duke University
4. University of Florida

United States critical infrastructure faces new cyber threats from adversarial nation-state actors in the form of malware-free attacks. Traditional cybersecurity techniques use rules-based methods to identify indicators of compromise on networks, often missing these sophisticated attacks. Our approach leverages multiple state of the art machine learning models in a pipeline to identify abnormal network events through sequential analysis. We combine both device and packet-level information into individual events to characterize anomalous network actions. The model is trained and tested on real network traffic from the Idaho National Lab High Performance Computing (HPC) with greater than 98% precision. It is capable of flagging malicious tactics used by adversaries in malware-free attacks, severe changes to the network, and abnormal user activity by network devices.

• Research Organization: Idaho National Laboratory (INL), Idaho Falls, ID (United States)
• Sponsoring Organization: USDOE Office of Nuclear Energy (NE); USDOE Office of Nuclear Energy (NE)
• DOE Contract Number: AC07-05ID14517
• OSTI ID: 3023455
• Report Number(s): INL/MIS-24-79682
• Resource Type: Conference proceedings
• Conference Information: Idaho National Laboratory Intern Poster Session, Idaho Falls, 04/07/2024 - 04/07/2024
• Country of Publication: United States
• Language: English

Related Subjects

99 - GENERAL AND MISCELLANEOUS
cybersecurity
machine learning