Research and Application of Anomaly Detection of Industrial Control System Based on Improved Zoe Algorithm

Due to the complexity of components and the diversity of protocols in industrial control systems, it is difficult to simply use content-based anomaly detection system with the background. This paper proposes an improved Zoe algorithm. In the algorithm, the similarity between traffics is calculated through sequence coverage. And we use Count-Mean-Min Sketch to store and count the sub-strings. Finally, we utilize clustering to achieve the anomaly detection of the industrial control system. The experimental results show that this algorithm can achieve higher detection rate and lower false positive rate of anomaly detection in industrial control systems.