A survey of intrusion detection on industrial control systems

Abstract

The modern industrial control systems now exhibit an increasing connectivity to the corporate Internet technology networks so as to make full use of the rich resource on the Internet. The increasing interaction between industrial control systems and the outside Internet world, however, has made them an attractive target for a variety of cyber attacks, raising a great need to secure industrial control systems. Intrusion detection technology is one of the most important security precautions for industrial control systems. It can effectively detect potential attacks against industrial control systems. In this survey, we elaborate on the characteristics and the new security requirements of industrial control systems. After that, we present a new taxonomy of intrusion detection systems for industrial control systems based on different techniques: protocol analysis based, traffic mining based, and control process analysis based. In addition, we analyze the advantages and disadvantages of different categories of intrusion detection systems and discuss some future developments of intrusion detection systems for industrial control systems, in order to promote further research on intrusion detection technology for industrial control systems.

A Review of Research Work on Network-Based SCADA Intrusion Detection Systems

“…Hu et al provided a survey of intrusion detection on industrial control systems [26]. They proposed IDS taxonomy based on the following techniques: protocol analysis, traffic mining, and control process analysis, and analyzed the advantages and disadvantages of different IDS categories.…”

“…Third, we try to establish correspondence between different approaches to the classification of intrusion detection methodologies used in SCADA networks. Unlike [22], [23] and [26], we do not attempt to propose SCADA-specific classification trees, but rather follow a well-established IDS classification for general-purpose IT systems.…”

An Improved Industrial Control System Device Logs Processing Method for Process-Based Anomaly Detection

“…[1]. Intrusion detection can be a viable approach to safeguard the ICS against cyber-attacks [2]. Apart from monitoring the network traffic, there is growing interest in exploiting physical properties (e.g., temperature, pressure, etc.)…”

RDTIDS: Rules and Decision Tree-Based Intrusion Detection System for Internet-of-Things Networks

“…Moreover, when talking about Industrial Control Systems (ICSs) that have specific requirements and characteristics novel taxonomies were recently proposed. Authors in [6] proposed a classification of IDSs ICS that divides them into three new categories: protocol analysis-based, traffic mining-based, and control process analysis-based.Countermeasures are taken according to the information obtained regarding the detected attacks from the detection systems. The better classification of the type of attack is provided, the more efficient will the chosen countermeasures be and the less will they affect the proper operation of the system or network.…”

“…Moreover, when talking about Industrial Control Systems (ICSs) that have specific requirements and characteristics novel taxonomies were recently proposed. Authors in [6] proposed a classification of IDSs ICS that divides them into three new categories: protocol analysis-based, traffic mining-based, and control process analysis-based.…”