OSCIDS: An Ontology based SCADA Intrusion Detection Framework

Abstract

Abstract:This paper presents the design, development, and validation of an ontology based SCADA intrusion detection system. The proposed system analyses SCADA network communications and can derive additional information based on the background knowledge and ontology models to enhance the intrusion detection data. The developed intrusion model captures network communications, cyber attacks and the context within the SCADA domain. Moreover, a set of semantic rules were constructed to detect various attacks and extract logical relationships among these attacks. The presented framework was extensively evaluated and a comparison to the state of the art is provided.

A Review of Research Work on Network-Based SCADA Intrusion Detection Systems

“…Timeliness analysis is available in 11 studies, as indicated in Table 7. Among the results concerning packet as a unit of analysis, deep packet inspection applied in [51] outperforms other techniques [41], [43], [46] at least for an order of magnitude. In the cases where dataset instance is observed as a unit of analysis, deep learning method presented in [63] performs much worse than clustering and outlier detection [60] and hybrid method presented in [61].…”

“…Expert systems were considered in [41], [55] and [58]. The system proposed in [41] uses ontology for extraction of semantic relations between attacks and detection of intrusions. Ontology is used to define the logical relationships between packet and attack instances, cyber attacks and the Modbus TCP communications.…”

“…Statistical-based techniques provide high accuracy, with low FPR and FNR rates [40], [47], [57]. Similarly, knowledge-based techniques provide good overall accuracy [41], [55], [58].…”