Detection of malicious requests aimed at disrupting the availability of cyber-physical systems

Financial University under the Government of the Russian Federation, Moscow, 125993, Russia

^* Corresponding author: shumskaya.ao@gmail.com

Abstract

The work is devoted to solving the problem of algorithmization of the security management processes of cyber-physical systems by detecting malicious requests aimed at disrupting the availability of management interfaces. Particular attention is paid to attacks aimed at denial of service of cyber-physical systems by sending HTTP-flood to web management interfaces. This paper proposes algorithmic provision for comprehensive adaptive analysis of incoming requests. The proposed algorithm for the detection of malicious requests analyses the activity of the investigated components of the cyber-physical system's web service at various network levels. The work applies a visual analysis and data processing method based on the representation as a single normalized set. The raw data of the analysed queries is grouped in a special way to detect a particular anomaly as a suspected threat. Examples of data changes and security responses are given. The experimental results confirm that the proposed algorithmic software achieves first- and second-order error reduction compared to the commonly used regression models in modern application-layer firewalls. The results obtained can be applied to the further development of the theory of information security, in particular the information security of cyber-physical systems and systems of processing of especially protected confidential information.