Using a Hybrid Automaton to Model the Protected System and Detect Anomalies in Network Traffic

The article describes an algorithm for detecting anomalies in the operation of network terminal devices of the automated control system by analyzing the data transmitted over the network. The relevance of the problem to be solved (legal requirements and recent information security incidents) is explained. The existing approaches are briefly described. The general architecture of the proposed method is described. From the network traffic, corresponding to the normal behavior of the modeled system, information registers are selected, on which the construction of a hybrid automaton is performed. To detect anomalies for each step the prediction of register values is made based on the corresponding values of the previous step, and the prediction error is used to decide about the presence of an anomaly in the system behavior. The proposed method allows modeling the system, explaining the reasons for the decisions made, and also allows the integration of expert knowledge into the model.