Various domains, including critical infrastructures, industry, and the private sector, deploy cyber-physical systems (CPS). These systems integrate IT and OT components and interact with the environment and therefore differ significantly from pure IT setups. However, CPS often operate as black boxes, hindering effective attack detection. Our research addresses the challenge of detecting attacks in CPS relying on network data and learning on normal behavior. We show the performance of two methods in use for attack detection without attack knowledge. We propose new memory update strategies that can be used in practice. Specifically, we optimize for temporal graphs using graph neural networks (GNN) to capture system behavior. Negative sampling helps to use one-class learning. Our results show that a temporal graph network (TGN), combined with negative sampling, is suitable for one-class learning and can be used for attack detection. Additionally, a simple heuristic suffices for detecting basic attacks. Notably, existing benchmark datasets do not adequately support one-class learning, highlighting the need for tailored evaluation.

Data reduction is a critical aspect of current research in advanced persistent threat attack detection. The challenge is handling the huge amount of data generated by system logging, which exposes dependencies among system entities, often depicted as provenance graphs. Data reduction methods aim to reduce the data size of provenance graphs, but their evaluation on non-public datasets limits the results' transferability and general applicability. This study compares state-of-the-art reduction methods for APT Attack Detection on publicly available provenance graph datasets, exploring their dependencies on graph characteristics and attack detection methods. One outcome of the work is that the effectiveness of many reduction methods depends highly on the underlying data. And secondly, using a reduction method does not necessarily negatively affect detection quality.

Das Forschungscluster Smart Data Analytics stellt in dem vorliegenden Band seine Forschung aus den Jahren 2019 und 2020 vor. In der ersten Hälfte des Bandes geben 20 Kurzporträts von laufenden oder kürzlich abgeschlossenen Projekten einen Überblick über die Forschungsthemen im Cluster. Enthalten in den Kurzporträts ist eine vollständige, kommentierte Liste der wissenschaftlichen Veröffentlichungen aus den Jahren 2019 und 2020. In der zweiten Hälfte dieses Bandes geben vier längere Beiträge exemplarisch einen tieferen Einblick in die Forschung des Clusters und behandeln Themen wie Fehlererkennung in Datenbanken, Analyse und Visualisierung von Sicherheitsvorfällen in Netzwerken, Wissensmodellierung und Datenintegration in der Medizin, sowie die Frage ob ein Computerprogramm Urheber eines Kunstwerkes im Sinne des Urheberrechts sein kann.