Enhancing Attack Detection Capabilities in BACnet/IP Networks Using Machine-Learning Models

• URL: http://arxiv.org/abs/2607.20686v1
• Date: Wed, 22 Jul 2026 19:37:44 GMT
• Title: Enhancing Attack Detection Capabilities in BACnet/IP Networks Using Machine-Learning Models
• Abstract summary: Building Automation Systems (BAS) manage critical building functions using protocols such as BACnet/IP.<n>BAS defenders have limited tooling and few labeled datasets for detecting BACnet-specific attacks.<n>One-Class SVM achieved the strongest overall performance, with an average F1 score of 0.864 across all attacks.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Building Automation Systems (BAS) manage critical building functions using protocols such as BACnet/IP, yet defenders have limited tooling and few labeled datasets for detecting BACnet-specific attacks. This work addresses these gaps through three contributions. First, CISA's Zeek BACnet parser is modified to produce a unified per-packet log, simplifying feature engineering for machine-learning (ML) pipelines. Second, a simulated BACnet/IP testbed is developed using bacpypes3 to model a small commercial HVAC system with physics-based device behavior, schedule-aware controller logic, and per-packet attack labeling. Third, five unsupervised anomaly detection models are evaluated using baseline traffic and six BACnet attack types, including denial of service, reconnaissance, property tampering, and false data injection. Results show that One-Class SVM achieved the strongest overall performance, with an average F1 score of 0.864 across all attacks and F1 scores above 0.99 for high-volume denial-of-service and reconnaissance attacks. Detection is much stronger for high-volume attacks, such as DoS attacks and reconnaissance, than stealthier techniques such as tampering and false data injection, which scored around 77%.

Related papers

• Cyberattack Detection in Virtualized Microgrids Using LightGBM and Knowledge-Distilled Classifiers [0.0]
  A complete virtual microgrid was designed and implemented in MG/Simulink.<n>A structured cyberattack framework was developed using MGLib to inject adversarial signals into secondary control pathways.<n>The results confirm that lightweight machine learning based intrusion detection methods can provide fast, accurate, and efficient cyberattack detection.
  arXiv  Detail & Related papers  (2026-01-07T01:23:13Z)
• Every Character Counts: From Vulnerability to Defense in Phishing Detection [22.101976874889147]
  Phishing attacks targeting both organizations and individuals are becoming an increasingly significant threat.<n>Current automatic detection methods often lack explainability and robustness in detecting new phishing attacks.<n>We investigate the effectiveness of character-level deep learning models for phishing detection, which can provide both robustness and interpretability.
  arXiv  Detail & Related papers  (2025-09-24T22:03:30Z)
• Large Language Model-Based Framework for Explainable Cyberattack Detection in Automatic Generation Control Systems [5.99333254967625]
  This paper proposes a hybrid framework that integrates machine learning (ML) and natural language explanations (LLMs) to detect cyberattacks.<n>The proposed framework effectively real-time detection with interpretable, high-fidelity explanations, addressing a critical need for actionable AI in smart grid cybersecurity.
  arXiv  Detail & Related papers  (2025-07-29T21:23:08Z)
• Poison Once, Control Anywhere: Clean-Text Visual Backdoors in VLM-based Mobile Agents [54.35629963816521]
  This work introduces VIBMA, the first clean-text backdoor attack targeting VLM-based mobile agents.<n>The attack injects malicious behaviors into the model by modifying only the visual input.<n>We show that our attack achieves high success rates while preserving clean-task behavior.
  arXiv  Detail & Related papers  (2025-06-16T08:09:32Z)
• CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations [53.036288487863786]
  We propose CANTXSec, the first deterministic Intrusion Detection and Prevention system based on physical ECU activations.<n>It detects and prevents classical attacks in the CAN bus, while detecting advanced attacks that have been less investigated in the literature.<n>We prove the effectiveness of our solution on a physical testbed, where we achieve 100% detection accuracy in both classes of attacks while preventing 100% of FIAs.
  arXiv  Detail & Related papers  (2025-05-14T13:37:07Z)
• Defending against Indirect Prompt Injection by Instruction Detection [109.30156975159561]
  InstructDetector is a novel detection-based approach that leverages the behavioral states of LLMs to identify potential IPI attacks.<n>InstructDetector achieves a detection accuracy of 99.60% in the in-domain setting and 96.90% in the out-of-domain setting, and reduces the attack success rate to just 0.03% on the BIPIA benchmark.
  arXiv  Detail & Related papers  (2025-05-08T13:04:45Z)
• Host-Based Network Intrusion Detection via Feature Flattening and Two-stage Collaborative Classifier [6.04077629908308]
  A hybrid network intrusion detection system that combines NIDS and HIDS is proposed to improve intrusion detection performance. A two-stage collaborative classifier is introduced that deploys two levels of ML algorithms to identify network intrusions. The proposed method is shown to generalize across two well-known datasets, CICIDS 2018 and NDSec-1.
  arXiv  Detail & Related papers  (2023-06-15T19:09:00Z)
• Can Adversarial Examples Be Parsed to Reveal Victim Model Information? [62.814751479749695]
  In this work, we ask whether it is possible to infer data-agnostic victim model (VM) information from data-specific adversarial instances. We collect a dataset of adversarial attacks across 7 attack types generated from 135 victim models. We show that a simple, supervised model parsing network (MPN) is able to infer VM attributes from unseen adversarial attacks.
  arXiv  Detail & Related papers  (2023-03-13T21:21:49Z)
• LogLAB: Attention-Based Labeling of Log Data Anomalies via Weak Supervision [63.08516384181491]
  We present LogLAB, a novel modeling approach for automated labeling of log messages without requiring manual work by experts. Our method relies on estimated failure time windows provided by monitoring systems to produce precise labeled datasets in retrospect. Our evaluation shows that LogLAB consistently outperforms nine benchmark approaches across three different datasets and maintains an F1-score of more than 0.98 even at large failure time windows.
  arXiv  Detail & Related papers  (2021-11-02T15:16:08Z)
• SOME/IP Intrusion Detection using Deep Learning-based Sequential Models in Automotive Ethernet Networks [2.3204135551124407]
  Intrusion Detection Systems are widely used to detect cyberattacks. We present a deep learning-based sequential model for offline intrusion detection on SOME/IP protocol.
  arXiv  Detail & Related papers  (2021-08-04T09:58:06Z)
• Adversarial EXEmples: A Survey and Experimental Evaluation of Practical Attacks on Machine Learning for Windows Malware Detection [67.53296659361598]
  adversarial EXEmples can bypass machine learning-based detection by perturbing relatively few input bytes. We develop a unifying framework that does not only encompass and generalize previous attacks against machine-learning models, but also includes three novel attacks. These attacks, named Full DOS, Extend and Shift, inject the adversarial payload by respectively manipulating the DOS header, extending it, and shifting the content of the first section.
  arXiv  Detail & Related papers  (2020-08-17T07:16:57Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.