As the precursor of cyber-attacks, the campaigns of scanning groups are able to reflect the attack target and attack trend to a great extent, which provide highly valuable threat intelligence for cyber defenders to understand the current cyber security situation. However, how to identify scanning groups in the context of limited information, especially in the absence of relevant threat intelligence, remains a challenging problem. In this paper, we utilize the honeynet as the unique data source to propose a scanning group identification system, Scanner-Hunter, which focuses on identifying scanning groups targeting ICS devices. To better characterize scanning patterns, a novel traffic representation scheme for scanning traffic is proposed, which is composed of a set of feature vectors to describe all the ICS request packets. On this basis, we propose a novel self-expanding multi-class classification (SEMCC) model and the IP prefix judgment, which are deliberately integrated to cope with sophisticated scanning groups. Take the Modbus protocol as an example, we implement a prototype of Scanner-Hunter, and use six years of real-world honeynet datasets to evaluate its performance. The experimental results illustrate its effectiveness and superior performance compared with some popular machine learning methods and existing SOTA scanning group identification methods. In addition, Scanner-Hunter is further leveraged to investigate the group distribution and maliciousness of 506 unknown scanners, and some suspicious attack groups with APT characteristics are analyzed. Furthermore, accurate scanning group information will contribute to revealing potential attack organizations and supporting decision making to prevent or interrupt cyber-attacks in time.

Industrial network systems are facing various new challenges, such as increasing functional failure factors, the accelerating penetration of information threats, and complex and diverse attack methods. Industrial networks are often vulnerable to natural or intentional disasters; therefore, it is highly invaluable to research to identify the influential nodes. Most of the state-of-the-art evaluates the importance of the nodes according to one or more network metrics. Moreover, there are no metrics reflecting all the properties of the network. In this paper, a novel method (Structure-based Identification Method, SIM) to identify the influential nodes in industrial networks is proposed based on the network structure, which goes beyond the use of network metrics. The SIM method extracts the weakly connected components, which are more likely to survive after the important nodes are attacked in the network. Evaluation results show that the SIM method obtains better results than the state-of-the-art methods to identify influential nodes in real-world industrial networks and has a good prospect to be applied in industrial application.

The device anomaly detection in an industrial control system (ICS) is essential for identifying devices with abnormal operating states or unauthorized access, aiming to protect the ICS from unauthorized access, malware, operational errors, and hardware failures. This paper addresses the issues of numerous manufacturers, complex models, and incomplete information by proposing a fingerprint extraction method based on ICS protocol communication models, applied to an anomaly detection model fine-tuned using the Llama3 model. By considering both hardware and software characteristics of ICS devices, the paper designs a fingerprint vector that can be extracted in both active and passive network communication environments. Experimental data include real ICS network traffic from an oilfield station and extensive ICS device traffic data obtained through network scanning tools. The results demonstrate that the proposed method outperforms existing methods in terms of accuracy and applicability, especially in differentiating devices from various manufacturers and models, significantly enhancing anomaly detection performance. The innovation lies in using large language models for feature extraction and the anomaly detection of device fingerprints, eliminating dependency on specific ICS scenarios and protocols while substantially improving detection accuracy and applicability.

IIoT (Industrial Internet of Things) has gained considerable attention and has been increasingly applied due to its ubiquitous sensing and communication. However, the sparse characteristic of sensing data in distributed IIoT networks may bring out tremendous challenges to implement the security protection measures. Based on the design of centralized data gathering and forwarding, this paper proposes a novel anomaly detection approach for IIoT sparse data, which can successfully collaborate the adaptive CEEMDAN (Complete Ensemble Empirical Mode Decomposition with Adaptive Noise) feature exploitation with one intelligent optimizing classification. Furthermore, in the adaptive CEEMDAN feature exploitation, the CEEMDAN energy entropy based on adaptive IMF (Intrinsic Mode Function) selection is designed to extract the sensing features from IIoT sparse data; in the intelligent optimizing classification, one effective OCSVM (One‐Class Support Vector Machine) classifier optimized by the IABC (Improved Artificial Bee Colony) swarm intelligence algorithm is introduced to detect various abnormal sensing features. The experimental results show that, not only does the CEEMDAN energy entropy based on adaptive IMF selection accurately describe the change of industrial production by analyzing the probability distribution and energy distribution of sparse sensing data, but also the proposed IABC‐OCSVM classifier has higher detection efficiency compared with the OCSVM classifiers optimized by other swarm intelligence algorithms.

Feature extraction plays an important role in constructing artificial intelligence (AI) models of industrial control systems (ICSs). Three challenges in this field are learning effective representation from high-dimensional features, data heterogeneity, and data noise due to the diversity of data dimensions, formats and noise of sensors, controllers and actuators. Hence, a novel unsupervised learning autoencoder model is proposed for ICS data in this paper. Although traditional methods only capture the linear correlations of ICS features, our deep industrial representation learning model (DIRL) based on a convolutional neural network can mine high-order features, thus solving the problem of high-dimensional and heterogeneous ICS data. In addition, an unsupervised denoising autoencoder is introduced for noisy ICS data in DIRL. Training the denoising autoencoder allows the model to better mitigate the sensor noise problem. In this way, the representative features learned by DIRL could help to evaluate the safety state of ICSs more effectively. We tested our model with absolute and relative accuracy experiments on two large-scale ICS datasets. Compared with other popular methods, DIRL showed advantages in four common indicators of AI algorithms: accuracy, precision, recall, and F1-score. This study contributes to the effective analysis of large-scale ICS data, which promotes the stable operation of ICSs.

Software Defined Networking (SDN) is a new type of network architecture, which provides an important way to implement automated network deployment and flexible management. However, security problems in SDN are also inevitable in industrial networks. In the research area of SDN security and traditional network security, feasibility and influence of defense in depth in industrial networks should thus be explored. In this paper, a security classification transmission method based on SDN in industrial networks is proposed, which provides a better security level of transmission paths. In the proposed method, the security classification transmission system is first presented. By designing five service mechanisms, including request, strategy generation, distribution/maintenance, updating/loading and execution, the security classification transmission service model is defined. In an experimental study, the proposed method is shown to be feasible in industrial heterogeneous networks and provide better security paths without affecting availability in the multi-domain and multi-nodes case of industrial networks.