Unknown Payload Anomaly Detection Based on Format and Field Semantics Inference in Cyber-Physical Infrastructure Systems

Protocol-aware methods are particularly suitable for detecting attacks that directly exploit industrial protocol semantics such as command and response injection, replay, spoofing, and MITM because they evaluate deviations in function codes, addressing schemes, request-response matching, and state-transition rules rather than only in coarse traffic statistics.

“First, protocol-aware methods are particularly suitable for detecting attacks that directly exploit industrial protocol semantics such as command and response injection, replay, spoofing, and MITM because they evaluate deviations in function codes, addressing schemes, request-response matching, and state-transition rules rather than only in coarse traffic statistics [47,49].”

Kim et al.'s method uses MAC/IP/port and length information to construct external signature groups, and multiple sequence alignment and field-distribution analysis automatically decompose headers and payloads into constant, categorical, and numerical fields.

“MAC/IP/port and length information are used to construct external signature groups. Multiple sequence alignment (MSA) and field-distribution analysis automatically decompose headers and payloads into constant, categorical, and numerical fields.”

Even relatively simple ML/DL classifiers can benefit from carefully engineered protocol features.

“Third, the current work also highlights that even relatively simple ML/DL classifiers can benefit from carefully engineered protocol features.”

Kim et al. demonstrate that unsupervised field-semantic inference combined with rule-based multilevel detection can capture a broad range of protocol-abuse scenarios without prior protocol specifications.

“while Kim et al. [47] demonstrate that unsupervised field-semantic inference combined with rule-based multilevel detection can capture a broad range of protocol-abuse scenarios without prior protocol specifications.”

Kim et al.'s inferred structure and semantics generate rules for external information, fixed fields, traffic patterns, and payload values, enabling multi-stage detection of response/command injections, DoS, and reconnaissance.

“Based on the inferred structure and semantics, rules are generated for external information, fixed fields, traffic patterns, and payload values. These rules enable multi-stage detection of various attacks, including response/command injections, DoS, and reconnaissance.”

Kim et al. [47] proposed a multi-layer anomaly detection method that infers packet format and field semantics without prior protocol knowledge, using Ethernet-based CPIS network traffic.

“Using Ethernet-based CPIS network traffic, Kim et al. [47] proposed a multi-layer anomaly detection method that infers packet format and field semantics without prior protocol knowledge.”