A data mining analysis of RTID alarms

SCADA (supervisory control and data acquisition) systems are used for controlling and monitoring industrial processes. We propose a methodology to systematically identify potential process-related threats in SCADA. Process-related threats take place when an attacker gains user access rights and performs actions, which look legitimate, but which are intended to disrupt the SCADA process. To detect such threats, we propose a semi-automated approach of log processing. We conduct experiments on a real-life water treatment facility. A preliminary case study suggests that our approach is effective in detecting anomalous events that might alter the regular process workflow.

show abstract

Section: Mitigation Approachmentioning

confidence: 99%

“…Several researches explore pattern mining of various logs for security purposes (e.g., alarm logs in [15,20], system calls in [16], event logs in [13]). These authors use pattern mining on burst of alarms to build episode rules.…”

Section: Related Workmentioning

confidence: 99%

A log mining approach for process monitoring in SCADA

Hadžiosmanović

Bolzoni

Hartel

2012

Int. J. Inf. Secur.

View full text Add to dashboard Cite

show abstract

“…The basic idea of our approach is that a frequent behaviour, over an extended period of time, is likely to be normal because event messages that reflect normal system activity are usually frequent [20,74,108]. Similar to Burns et al [28], we found a large fraction of events that always appear with the same number of daily occurrences (e.g., timer-triggered event).…”

Section: Approachsupporting

confidence: 60%

“…Several researches explore pattern mining of various logs for security purposes (e.g., alarm logs in [56,74], system calls in [64], event logs in [50]). These authors use pattern mining on burst of alarms to build episode rules.…”

Section: Related Workmentioning

confidence: 99%

Process matters: cyber security in industrial control systems

Hadžiosmanović¹

View full text Add to dashboard Cite

“…The following terminology is often used when referring to the counts tabulated in a confusion matrix [12]. The evaluation results for the above four windows functions reveals that the performance using our prediction model approaches i.e classification methods.…”

Section: Confusion Matrixmentioning

confidence: 95%

Load Shedding using Window Aggregation Queries on Data Streams

Senthamilarasu¹,

Hemalatha²

2012

IJCA

View full text Add to dashboard Cite

The processes of extracting knowledge structures for continuous, rapid records are known as the Data Stream Mining. The main issue in stream mining is handling streams of elements delivered rapidly which makes it infeasible to store everything in active storage. To overcome this problem of handling voluminous data we exposed a novel load shedding system using window based aggregate function of the data stream in which we accept those tuples in the stream that meet a criterion. Accepted tuples are conceded to another process as a stream, while further tuples are dropped. This proposed model conceivably segregates the data input stream into windows and probabilistically decides which tuple to drop based on the window function. The best window aggregate function used for dropping tuples is identified with the three prediction models used in data mining they are Decision Tree, Naïve Bayes and Logistic Regression. The result shows that the cumulative distance and density rank functions outperforms the remaining methods. Distinct to prior methods, our method preserves uniformity of windows all over a query plan, and constantly distributes subsets of the original query responds with insignificant denial in the excellence of the consequence.

show abstract

A data mining analysis of RTID alarms

Cited by 166 publications

References 6 publications

A log mining approach for process monitoring in SCADA

A log mining approach for process monitoring in SCADA

Process matters: cyber security in industrial control systems

Load Shedding using Window Aggregation Queries on Data Streams

Contact Info

Product

Resources

About