Representation of Industrial Traffic and Encoding of Protocol Semantics for Transformer Models in Small Industrial Ethernet Networks

Relevance. In modern Industrial Ethernet networks, anomaly and cyberattack detection requires taking the protocol semantics of network traffic into account. The relevance of this study is determined by the growing number of attacks on industrial control systems, the increasing integration of production and corporate networks, and the widespread use of industrial protocols, some of which were not originally designed to meet modern cybersecurity requirements. Traditional signature-based detection tools are limited in their ability to identify previously unknown and stealthy attacks, while approaches based solely on statistical flow characteristics often lose important information about communication logic, message roles, and application-layer features of industrial protocols. An additional challenge is the shortage of labeled data typical of real industrial environments, which complicates the training of robust attack detection models.

Objective. To develop and evaluate a method for representing industrial traffic as tokenized sequences suitable for transformer models in small Industrial Ethernet networks.

Methods. Flow- and session-level packet aggregation, semantic tokenization of Modbus/TCP and OPC UA protocol fields, embeddings with positional encoding, self-supervised pre-training, and subsequent fine-tuning of the model for session classification were used. The approach was evaluated on the Malware in Smart Factory dataset.

Results. A protocol-aware representation of network sessions that preserves communication context and the specific features of industrial protocols was developed. On the Malware in Smart Factory dataset, the transformer model achieved an F1-score of 99.3 % in attack detection and outperformed LSTM and CNN models; pre-training further improved classification performance.

Theoretical and practical significance. The proposed approach provides a unified input format for analyzing Modbus/TCP and OPC UA traffic and can be used in anomaly and intrusion detection systems for small industrial networks.

1. Dehlaghi-Ghadim A., Moghadam H.M., Balador A., Hansson H. Anomaly Detection Dataset for Industrial Control Systems. IEEE Access. 2023;11:107982–107996. DOI:10.1109/ACCESS.2023.3320928. EDN:ZMFCCE

2. Shi Z., Luktarhan N., Song Y., Yin H. TSFN: A Novel Malicious Traffic Classification Method Using BERT and LSTM. Entropy. 2023;25(5):821. DOI:10.3390/e25050821. EDN:HNRTUY

3. Afifi F., Zaki F., Hanif H., Aqil N., Anuar N.B. Transformer-based tokenization for IoT traffic classification across diverse network environments. PeerJ Computer Science. 2025;11(e3126). DOI:10.7717/peerj-cs.3126. EDN:LFNGZM

4. Marino D.L., Wickramasinghe C.S., Rieger C., Manic M. Self-Supervised and Interpretable Anomaly Detection Using Network Transformers. IEEE Transactions on Industrial Informatics. 2025;21(5):4252–4261. DOI:10.1109/TII.2025.3534443. EDN:GDCTHE

5. Buczak A.L., Guven E. A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection. IEEE Communications Surveys & Tutorials. 2016. Vol. 18. Iss. 2. PP. 1153–1176. DOI:10.1109/COMST.2015.2494502

6. Mitchell R., Chen I.-R. A Survey of Intrusion Detection Techniques for Cyber-Physical Systems. ACM Computing Surveys. 2014;46(4):55. DOI:10.1145/2542049. EDN:OQKUJE

7. Mathur A.P., Tippenhauer N.O. SWaT: a water treatment testbed for research and training on ICS security. Proceedings of the International Workshop on Cyber-Physical Systems for Smart Water Networks, CySWater, 11 April 2016, Vienna, Austria. IEEE; 2016. p.31–36. DOI:10.1109/CySWater.2016.7469060

8. Ahmed C.M., Palleti V.R., Mathur A.P. WADI: a water distribution testbed for research in the design of secure cyber physical systems. Proceedings of the 3rd International Workshop on Cyber-Physical Systems for Smart Water Networks, CyS-Water, 21 April 2017, Pittsburgh, USA. New York: ACM; 2017. p.25–28. DOI:10.1145/3055366.3055375

9. Anthi E., Williams L., Burnap P., Jones K. A three-tiered intrusion detection system for industrial control systems. Journal of Cybersecurity. 2021;7(1):tyab006. DOI:10.1093/cybsec/tyab006. EDN:PZNPOU

10. Stouffer K., Pease M., Tang C., Zimmerman T., Pillitteri V., Lightman S., et al. NIST SP 800-82 Rev. 3. Guide to Operational Technology (OT) Security. 2023. DOI:10.6028/NIST.SP.800-82r3

11. Goldenberg I., Wool A. Accurate modeling of Modbus/TCP for intrusion detection in SCADA systems. International Journal of Critical Infrastructure Protection. 2013;6(2):63–75. DOI:10.1016/j.ijcip.2013.05.001

12. Azab A., Khasawneh M., Alrabaee S., Choo K.K.R., Sarsour M. Network traffic classification: Techniques, datasets, and challenges. Digital Communications and Networks. 2024;10(3):676–692. DOI:10.1016/j.dcan.2022.09.009. EDN:BWGLKV

13. Mirsky Y., Doitshman T., Elovici Y., Shabtai A. Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection. Network and Distributed System Security Symposium, NDSS, 18–21 February 2018, San Diego, USA. 2018. DOI:10.14722/ndss.2018.23204

14. Lotfollahi M., Siavoshani M.J., Zade R.S.H., Saberian M. Deep packet: a novel approach for encrypted traffic classifica-tion using deep learning. Soft Computing. 2020;24:1999–2012. DOI:10.1007/s00500-019-04030-2. EDN:XWSLQV

15. Vaswani A., Shazeer N., Parmar N., Uszkoreit J., Jones L., Gomez A.N., et al. Attention Is All You Need. Advances in Neural Information Processing Systems. 2017. DOI:10.48550/arXiv.1706.03762

16. Devlin J., Chang M.-W., Lee K., Toutanova K. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics, NAACL, 2-7 June 2019, Minneapolis, USA. 2019. DOI:10.48550/arXiv.1810.04805

17. Lin X., Xiong G., Gou G., Li Z., Shi J., Yu J. ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification. arXiv2202.06335. 2022. DOI:10.48550/arXiv.2202.06335

18. Meng X., Lin C., Wang Y., Zhang Y. NetGPT: Generative Pretrained Transformer for Network Traffic. arXiv:2304.09513. 2023. DOI:10.48550/arXiv.2304.09513

19. Brenner P., Fabini J., Offermanns M., Semper S., Zseby T. Malware communication in smart factories: A network traffic data set. Computer Networks. 2024;255:110804. DOI:10.1016/j.comnet.2024.110804. EDN:FZKJWH.

20. Malware in Smart Factory. TU Wien Research Data Repository. 2024. DOI:10.48436/2sv8c-ykc69

21. Paxson V. Bro: a system for detecting network intruders in real-time // Computer Networks. 1999. Vol. 31. Iss. 23–24. PP. 2435–2463. DOI:10.1016/S1389-1286(99)00112-7

22. Dietmüller A., Ray S., Jacob R., Vanbever L. A new hope for network model generalization. Proceedings of the 21st ACM Workshop on Hot Topics in Networks, HotNets ’22, 14–15 November 2022, Austin, USA. New York: Association for Computing Machinery; 2022. p.152–159. DOI:10.1145/3563766.3564104

23. Teixeira A.M.H., Shames I., Sandberg H., Johansson K.H. Revealing Stealthy Attacks in Control Systems. Proceedings of the 50th Annual Allerton Conference on Communication, Control, and Computing, 01–05 October 2012, Monticello, USA. IEEE; 2012. p.1806–1813. DOI:10.1109/Allerton.2012.6483441

24. Teixeira A., Shames I., Sandberg H., Johansson K.H. A secure control framework for resource-limited adversaries. Automatica. 2015;51:135–148. DOI:10.1016/j.automatica.2014.10.067

25. Kim J., Back J., Park G., Lee C., Shim H., Voulgaris P.G. Neutralizing zero dynamics attack on sampled-data systems via generalized holds. Automatica. 2020;113:108778. DOI:10.1016/j.automatica.2019.108778. EDN:GKLFBB

26. Tuli S., Casale G., Jennings N.R. TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate Time Series Data. Proceedings of the VLDB Endowment. 2022;15(6):1201–1214. DOI:10.14778/3514061.3514067. EDN:LPTVUQ