Intrusion Detection in Cyber-Physical Systems Based on Petri Net

Ghazi, Zeinab; Doustmohammadi, Ali

doi:10.5755/j01.itc.47.2.16277

Cited by 9 publications

(7 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Specification-based techniques are applied for specific protocols, standalone or in combination with other methods [45], [46], [51]. More comprehensive solutions use a number of integrated techniques to detect a variety of attacks more accurately [43], [46], [48], [52], [53], [61].…”

Section: A Detection Methodology Protected Protocols and Implementamentioning

confidence: 99%

See 1 more Smart Citation

A Review of Research Work on Network-Based SCADA Intrusion Detection Systems

2020

View full text Add to dashboard Cite

Specific intrusion detection systems (IDSs) are needed to secure modern supervisory control and data acquisition (SCADA) systems due to their architecture, stringent real-time requirements, network traffic features and specific application layer protocols. This article aims to contribute to assess the state-ofthe-art, identify the open issues and provide an insight for future study areas. To achieve these objectives, we start from the factors that impact the design of dedicated intrusion detection systems in SCADA networks and focus on network-based IDS solutions. We propose a structured evaluation methodology that encompasses detection techniques, protected protocols, implementation tools, test environments and IDS performance. Special attention is focused on assessing implementation maturity as well as the applicability of each surveyed solution in the Future Internet environment. Based on that, we provide a brief description and evaluation of 26 selected research papers, published in the period 2015-2019. Results of our analysis indicate considerable progress regarding the development of machine learning-based detection methods, implementation platforms, and to some extent, sophisticated testbeds. We also identify research gaps and conclude the analysis with a list of the most important directions for further research.

show abstract

Section: A Detection Methodology Protected Protocols and Implementamentioning

confidence: 99%

“…Ghazi and Doustmohammadi describe an algorithm based on Petri Net that simultaneously detects misuse and anomaly behavior of the cyber physical system [53]. Anomaly detection is based on Neural First Order Hybrid Petri Net (NFOHPN) with online fast independent component analysis (multivariate statistical method).…”

Section: F Hybrid Techniquesmentioning

confidence: 99%

A Review of Research Work on Network-Based SCADA Intrusion Detection Systems

2020

View full text Add to dashboard Cite

show abstract

“…Werlinger et al [14] state that the result of using IDS is not always clear. It is also interesting that practically the same imperfections have existed for many years [3], [15], [16] and even the new methods [13] [17] do not help to avoid them.…”

Section: Review Of Related Workmentioning

confidence: 99%

“…Heo et al [23] suggested a system design that helps to maintain a certain level of quality of service and quality of security service in threatening environments. Nevertheless, despite all the advantages provided by such systems, they still have many deficiencies that are fully disclosed in the papers [16][17][18][19][20][21].…”

Section: Review Of Related Workmentioning

confidence: 99%

Logical filter approach for early stage cyber-attack detection

et al. 2019

View full text Add to dashboard Cite

The planned in advance cyber-attacks cause the most damage for the users of the information systems. Such attacks can take a very long time, require considerable financial and human resources, and therefore, they can only be organized by large interest groups. Furthermore, current intrusion detection systems, intrusion prevention systems and intrusion response systems used to protect against cyber-attacks have several shortcomings. Such systems respond only to the attack itself when it is too late to take a preventive action and they are not suitable for detecting an attack in early stages when it is possible to block the attack and minimize the losses. Early detection requires detailed monitoring of network and system parameters to be able to accurately identify the early stages of the attack when it is still possible to kill the attack chain. In this paper, we propose to consider an attack chain consisting of nine stages. The method to detect early stage cyberattack based on the attack chain analysis using hardware implementation of logical filters is suggested. The performed experiment acknowledges the possibility to detect the attack in the early stages.

show abstract

“…Intrusion detection [14] was proposed in CPS based on the Petri Net (PN). The main aim of this technique was simultaneously detecting misuse and anomaly characteristics of the CPSs.…”

Section: Survey On Cyber-attack Detection Schemesmentioning

confidence: 99%