A Hybrid Anomaly Detection Framework for OT Networks Using Leaky Bucket Algorithm and Principal Component Analysis

The increasing sophistication of cybersecurity threats in Operational Technology (OT) environments highlights the necessity for a lightweight and efficient anomaly detection framework to identify and mitigate these threats. This paper proposes a hybrid multivariate anomaly detection framework for OT networks using Leaky Bucket Algorithm (LBA) and Principal Component Analysis (PCA). The framework employs a multi-level approach, where LBA performs the initial anomaly detection, and the identified anomalies are forwarded to PCA for in-depth analysis and validation. The proposed framework's performance is evaluated against standard PCA in detecting various cyberattacks, including Denial-of-Service (DoS), Man-in-the-Middle (MiTM) and Command Injection Attacks (CIA) in an OT testbed. The experimental results demonstrate that the proposed framework outperformed the standard PCA in detecting various attacks using performance metrics such as accuracy, precision, recall, F1-score and false negative rate.