Search papers, labs, and topics across Lattice.
This paper develops two anomaly detection models that integrate features from both cyber and electromagnetic domains to enhance Cyber Situational Awareness (CSA). Using the ZBDS2023 dataset, which includes both benign and attack behaviors, the study evaluates a supervised Random Forest model and an unsupervised LSTM-Autoencoder, achieving an F1-score of 89.76% and 64.09% respectively. The findings underscore the importance of combining physical and traffic-level features to improve the detection of simultaneous anomalies in military operations, while also highlighting the need for more discriminative features to better differentiate between normal and attack behaviors.
Achieving an F1-score of 89.76% with a Random Forest model reveals the potential of hybrid anomaly detection in military cyber operations.
Military operations benefit from the coordination between kinetic and non-kinetic domains. In particular, the coordination of cyber operations and electromagnetic warfare has become increasingly relevant for gaining operational advantage. This coordination is also relevant for Cyber Situational Awareness (CSA), where the Observe-Orient-Decide-Act (OODA) loop requires monitoring and interpreting evidence from heterogeneous sources. In this context, anomalies may appear not only in the physical behavior of signals, but also in the communication behavior observed at the traffic level. However, many existing anomaly detection proposals focus on only one of these perspectives, limiting their ability to characterize events that manifest simultaneously in the electromagnetic spectrum and cyberspace. To address this limitation, this work develops and evaluates two anomaly detection models that combine features from both domains. More specifically, the study uses the ZBDS2023 dataset, which contains traffic from nodes in a mesh network, including benign and attack behaviors. Thus, this dataset provides physical-level features, traffic-level features, and labeled attacks. Two detection approaches are evaluated: a supervised model based on Random Forest and an unsupervised model using LSTM-Autoencoder. The results show that learning-based models can detect patterns combining both levels, especially under a supervised approach, achieving an F1-score of 89.76% with Random Forest and 64.09% with LSTM-Autoencoder. Although these results indicate that the proposed models can support CSA by improving the observation and interpretation of anomalous behavior, the subtle differences between normal and attack samples highlight the need for richer discriminative features.
