A Survey of Specification-based Intrusion Detection Techniques for Cyber-Physical Systems

Abstract

Cyber-physical systems (CPS) integrate computation and communication capabilities to monitor and control physical systems. Even though this integration improves the performance of the overall system and facilitates the application of CPS in several domains, it also introduces security challenges. Over the years, intrusion detection systems (IDS) have been deployed as one of the security controls for addressing these security challenges. Traditionally, there are three main approaches to IDS, namely: anomaly detection, misuse detection and specificationbased detection. However, due to the unique attributes of CPS, the traditional IDS need to be modified or completely replaced before it can be deployed for CPS. In this paper, we present a survey of specification-based intrusion detection techniques for CPS. We classify the existing specification-based intrusion detection techniques in the literature according to the following attributes: specification source, specification extraction, specification modelling, detection mechanism, detector placement and validation strategy. We also discuss the details of each attribute and describe our observations, concerns and future research directions. We argue that reducing the efforts and time needed to extract the system specification of specification-based intrusion detection techniques for CPS and verifying the correctness of the extracted system specification are open issues that must be addressed in the future.

Insights into Modern Intrusion Detection Strategies for Internet of Things Ecosystems

“…The proliferation of different attack types in the network [5,10] and the growing increase in the exchange of data between devices pose the requirement to secure IoT networks and devices. Currently, there are different techniques to detect such attacks [7,8,[12][13][14], and Figure 2 presents the techniques involved in deploying and detecting intrusions or attacks in IDS.…”

“…The proliferation of different attack types in the network [5,10] and the growing increase in the exchange of data between devices pose the requirement to secure IoT networks and devices. Currently, there are different techniques to detect such attacks [7,8,[12][13][14], and Figure 2 presents the techniques involved in deploying and detecting intrusions or attacks in IDS. Anomaly-based IDS (AIDS) are designed to identify malicious activities by establishing a baseline of normal device or network behaviour and signalling any deviations as potential intrusions.…”

“…Moreover, Umer et al [13] analyzed ML methods for intrusion detection across a 10-dimensional framework, evaluating their effectiveness in certain scenarios, pinpointing challenges, and suggesting areas for future research and enhancement. Concurrently, Nweke [14] thoroughly reviewed SPIDS techniques for Cyber-Physical Systems (CPS), classifying them by different characteristics, and provided insights into ongoing challenges and directions for future research, particularly in specification extraction and validation. Likewise, Zarpelão et al [15] examined IoT-based IDSs to discern trends, challenges, and future research opportunities, emphasizing strategies for IDS deployment, detection methodologies, security threats, and validation processes.…”

Leveraging the Training Data Partitioning to Improve Events Characterization in Intrusion Detection Systems

“…It can base its operation on different modalities, the most common of them are: (i) anomaly-based, according to which it classifies the network activities based on a rules/heuristic-based strategy, then by analyzing their behavior instead querying a database of known patterns [25]; (ii) signature-based, where the new network activity pattern is compared to the known patterns stored in a database, and it is classified based on the basis of this comparison process [26]; (iii) specification-based, according to which the system inspects the involved protocols to detect anomalous sequences that may refer to an attack in progress [27]; (iv) hybrid-based, which does not represent a pure modality but a combination of the previous ones [28].…”

Cyber-Security of Industrial Internet of Things in Electric Power Systems

“…When sufficient information about a system's behaviors is not available, a specification source is developed by simulation. This source is then used to identify intrusions by monitoring the deviation of system behaviors from simulated attack-free specifications [128].…”