In order to protect ICS (Industrial Control System), there are many discussions about ICS security from the viewpoint of cyber defenders. ICS, however, has its specific difficulties to install IT security means such as antivirus with firewall software, because of its 24 hour-a-day, 365 days-a-year non-stop operation under the safety first culture. Comparing IT system, ICS has a certain advantage related to handling against cyber-attacks with operation staffs and safety devices installed in a plant. It is indispensable to fully utilize this advantage, ant at the same time, it is necessary to create leeway in terms of mental and time state to start staff's situated actions based on the safety training. In order to prepare maximum leeway and to prevent effective and concentrated cyber-attacks, human factors of attackers should be analyzed based on their attack scenarios each having three stages; "

Industrial control systems (ICS) have hidden vulnerabilities that cannot be usually solved by IT security tools, because of their 24 h 365 d non-stop, non-update and non-patch operation. There is, however, very limited report of cyber-attacks, so that owners of critical infrastructures do not have much attention for their ICS protection. This is a kind of misunderstanding of the current situation caused by a lacking of capability to detect a cyber-intrusion. In order to apply an Intrusion Detection System (IDS), it is di cult to make the complete white list of communication packets, and it is also di cult to perform anomaly detection by checking the payload of packet one by one. This paper de nes characteristics of communication in the ICS network and proposes a methodology to visualize the ICS network behavior. An illustrative example of pseudo cyber-attack is also prepared for understanding our proposed method.

No abstract

No abstract

No abstract