Predictive Abuse Detection for a PLC Smart Lighting Network Based on Automatically Created Models of Exponential Smoothing

One of the basic elements of a Smart City is the urban infrastructure management system, in particular, systems of intelligent street lighting control. However, for their reliable operation, they require special care for the safety of their critical communication infrastructure. This article presents solutions for the detection of different kinds of abuses in network traffic of Smart Lighting infrastructure, realized by Power Line Communication technology. Both the structure of the examined Smart Lighting network and its elements are described. The article discusses the key security problems which have a direct impact on the correct performance of the Smart Lighting critical infrastructure. In order to detect an anomaly/attack, we proposed the usage of a statistical model to obtain forecasting intervals. Then, we calculated the value of the differences between the forecast in the estimated traffic model and its real variability so as to detect abnormal behavior (which may be symptomatic of an abuse attempt). Due to the possibility of appearance of significant fluctuations in the real network traffic, we proposed a procedure of statistical models update which is based on the criterion of interquartile spacing. The results obtained during the experiments confirmed the effectiveness of the presented misuse detection method

Incoherent Dictionary Learning for Sparse Representation in Network Anomaly Detection

In this article we present the use of sparse representation of a signal and incoherent dictionary learning method for the purpose of network traffic analysis. In learning process we use 1D INK-SVD algorithm to detect proper dictionary structure. Anomaly detection is realized by parameter estimation of the analyzed signal and its comparative analysis to network traffic profiles. Efficiency of our method is examined with the use of extended set of test traces from real network traffic. Received experimental results confirm effectiveness of the presented method

Anomaly Detection for Smart Lighting Infrastructure with the Use of Time Series Analysis

One of the basic elements of every Smart City is currently a system of managing urban infrastructure, in particular, smart systems controlling street lighting. Ensuring proper level of security, continuity and failure-free operation of such systems, in practice, seems not yet a solved problem. In this article we present proposals of a system allowing to detect different types of anomalies in network traffic for Smart Lighting critical infrastructure realized with the use of Power Line Communication technology. Furthermore, there is proposed and described the structure of the examined Smart Lighting Communications Network along with its particular elements. We discuss key security aspects which affect proper operation of advance communication infrastructure, i.e. possibility of occurrence of abuse connected both to activity of external factors which could disturb transmission of steering signals, as well as active forms of attack aiming at influencing the informative content of the transmitted data. In the article, there is also presented an effective and quick anomaly detection method in the tested network traffic represented by suitable time series. At the initial stage of the method, the process of detection and elimination of potential outlying observations was realized by one-dimensional quartile criterion. Data prepared in this manner was used for learning recurrent neural networks, i.e. Long and Short-Term Memory types, in order to predict values of the analyzed time series. Further, tests were performed on relations between the forecasted network traffic and its real variability in order to detect abnormal behavior which could mean an attempt of an attack or abuse. Due to a possibility of occurrence of significant fluctuations in real network traffic of the tested Smart Lighting infrastructure, we propose a procedure of recurrent learning with the use of neural networks to obtain more accurate forecasting. The results achieved by means of the performed experiments confirmed effectiveness of the presented method and proper choice of the Long Short-Term Memory neural network for forecasting the analyzed time series

Anomaly Detection in Smart Metering Infrastructure with the Use of Time Series Analysis

The article presents solutions to anomaly detection in network traffic for critical smart metering infrastructure, realized with the use of radio sensory network. The structure of the examined smart meter network and the key security aspects which have influence on the correct performance of an advanced metering infrastructure (possibility of passive and active cyberattacks) are described. An effective and quick anomaly detection method is proposed. At its initial stage, Cook’s distance was used for detection and elimination of outlier observations. So prepared data was used to estimate standard statistical models based on exponential smoothing, that is, Brown’s, Holt’s, and Winters’ models. To estimate possible fluctuations in forecasts of the implemented models, properly parameterized Bollinger Bands was used. Next, statistical relations between the estimated traffic model and its real variability were examined to detect abnormal behavior, which could indicate a cyberattack attempt. An update procedure of standard models in case there were significant real network traffic fluctuations was also proposed. The choice of optimal parameter values of statistical models was realized as forecast error minimization. The results confirmed efficiency of the presented method and accuracy of choice of the proper statistical model for the analyzed time series