ICS Network Anomaly Classification Using SARIMA and LSTM

The patent combines traditional machine learning algorithms (SARIMA) for statistical analysis with deep learning algorithms (LSTM) for sequence modeling to create a hybrid anomaly detection system. The SARIMA model captures linear trends and seasonal patterns in ICS communication traffic, while the LSTM model learns complex non-linear temporal dependencies. This merging of different algorithmic approaches enables both high reliability in anomaly detection and precise real-time anomaly location by leveraging the complementary strengths of each algorithm.

The patent creates a composite anomaly detection model that integrates multiple algorithmic components: SARIMA for statistical forecasting, LSTM for deep learning-based sequence prediction, and a fusion mechanism that combines their outputs. This composite structure allows the system to achieve both high detection reliability through diverse algorithmic perspectives and high measurement precision through the coordinated analysis of multiple model predictions, effectively resolving the contradiction between these two performance metrics.

The patent segments the anomaly classification process into distinct stages: traffic data collection and preprocessing, anomaly detection using SARIMA and LSTM models, anomaly classification based on detected patterns, and source tracing. Each segment handles a specific aspect of the classification task with appropriate algorithmic complexity. This segmentation allows the system to achieve high classification accuracy through specialized processing at each stage while managing overall algorithm complexity by breaking down the problem into manageable components with clear interfaces.

The patent applies different algorithmic approaches with appropriate complexity levels to different aspects of the classification task. Simple statistical methods are used for basic traffic pattern recognition, while more complex deep learning methods are applied only where necessary for capturing temporal dependencies. The system optimizes the local quality of each algorithmic component according to its specific function, thereby achieving high overall classification accuracy without uniformly high complexity across all processing stages.

The patent performs preliminary training of the SARIMA and LSTM models using historical ICS communication traffic data during an offline phase. This preliminary action pre-lloads the models with learned patterns and characteristics of normal and anomalous traffic. During online deployment, the pre-trained models can automatically detect and classify anomalies without requiring manual prior knowledge input, thereby easing deployment while maintaining adaptability to new attack patterns through the models' inherent learning capabilities.

The hybrid anomaly detection system enables the ICS communication network to perform self-service anomaly detection and classification. The SARIMA and LSTM models automatically learn traffic patterns and identify anomalies without continuous human intervention or manual rule updates. The system adapts to new attack patterns by continuously analyzing incoming traffic data, reducing dependency on priori knowledge while maintaining high adaptability through its self-learning mechanisms.