Service Function Chain Anomaly Detection Method for Cyber Threat Detection in Aviation Information System

The aviation information system is a large-scale critical national infrastructure that is rapidly evolving towards digitalization and intelligence in response to the growing demand for air traffic services. With the application of emerging network technologies such as cloud computing, edge computing, and network function virtualization (NFV), the openness and connectivity of the aviation information system are continually enhanced, while the attack surface for cyber threats is also expanding. In response to the cyber threats faced by the aviation information system, a service function chain (SFC) anomaly detection method based on Attention-LSTM-CoAE-SVDD-PSO (AMASS) is proposed. This approach incorporates an anomaly detection mechanism that processes prediction and reconstruction modules in parallel. First, the Attention-LSTM-based prediction module learns the temporal correlation of SFC data to facilitate SFC data forecasting. Second, the CoAE-based reconstruction module learns the spatial correlation of SFC data for data reconstruction. Finally, the SVDD-PSO-based classification module learns the characteristics of the prediction deviation and reconstruction deviation, adaptively determining the classification threshold to achieve unsupervised anomaly detection of SFC data. Experimental results demonstrate that the proposed method can effectively counter cyberattacks with varying attack patterns, intensities, and durations. Furthermore, comparisons with other methods proposed in the literature further validate the superior performance of AMASS in terms of detection rate, miss detection rate, and accuracy.