Analyzing Changes in the Self-similarity of Industrial Control System Network Traffic Caused by Bursty Sources

Abstract

It is well documented that bursty sources on a network, such as those derived from human-type communications (HTC), result in the traffic exhibiting self-similar behavior. However, limited research has been conducted into the self-similarity of networks consisting of machine-type communications (MTC), such as the Internet of Things (IoT) or industrial control system (ICS) devices. Furthermore, it has not been shown how MTC traffic patterns change when aggregated with bursty, human traffic. This research uses publicly available ICS datasets to investigate the effects of adding bursty traffic to MTC networks as characterized by the self-similarity of the traffic. As MTC networks exhibit a lower degree of self-similarity when compared to networks containing HTC, we demonstrate that even a small percentage of bursty traffic introduced to the MTC network will cause an increase in self-similarity. We present these findings as a foundation for utilizing changes in self-similarity, as measured by the Hurst parameter, for anomaly detection of human activity in traditionally non-bursty networks.