Detection of Real-Time Anomalies in Network Environment Using Deep Learning

Abstract

The exponentially growing overlap of the networks of Information Technology (IT) and Operational Technology (OT) of which the widespread establishment of the Internet of Things (IoT) is a main feature of Industry 4.0 has greatly increased the attack surface targeted at the critical infrastructure. This convergence is not only providing massive operational efficiencies; it is also creating a new form of unprecedented cyber-physical risks and this requires the deployment of advanced anomaly detection processes. The signature-based security tools have proved inefficient due to the increase in sophistication and invention of new cyber threats, analysis of zero-day attacks, and clandestine insider threats. Deep learning (DL) has become an efficient paradigm, and it is the only technology that can analyse the massive, multi-dimensional and high-dimensional data streams originating in a decentralised way as far as recognising in complex patterns and subtle deviations that may signal of malicious. This paper categorizes the algorithm based on deep learning that detects anomalies and provides an in-depth discussion of the recent deep learning-based anomaly detection algorithms with emphasis on the context that is related to these converged environments. It also evaluates critically the application of the various DL structures such as Autoencoders, Recurrent Neural Networks (RNNs), Convolutional Neural Networks (CNNs), Transformers and Graph Neural Networks (GNNs) in the identification of the threatening activities, comprising Distributed Denial of Service (DDoS) attacks, malware as well as cyber-physical. Along with this, the paper illuminates the great difficulties that occur in practice (deployment), including but are not limited to data scarcity and imbalance, interpretability, computational overhead, and adversarial. Among the most prominent trends, one is aware of the transition of the models to unsupervised and hybrid with a special focus on the necessity to consider the explosion of Explainable AI (XAI), Federated Learning (FL) and the necessity of solid design of AI. The paper concludes by highlighting some of the main areas where future research can be done to come up with more trustworthy, believable and practically usable anomaly detection system in strategic critical infrastructures.