Sequence-aware Intrusion Detection in Industrial Control Systems

Abstract

Nowadays, several threats endanger cyber-physical systems. Among these systems, industrial control systems (ICS) operating on critical infrastructures have been proven to be an attractive target for attackers. The case of Stuxnet has not only showed that ICSs are vulnerable to cyber-attacks, but also that some of these attacks rely on understanding the processes beyond the employed systems and using such knowledge to maximize the damage. This concept is commonly known as "semantic attack". Our paper discusses a specific type of semantic attack involving "sequences of events". Common network intrusion detection systems (NIDS) generally search for single, unusual or "not permitted" operations. In our case, rather than a malicious event, we show how a specific series of "permitted" operations can elude standard intrusion detection systems and still damage an infrastructure. Moreover, we present a possible approach to the development of a sequence-aware intrusion detection system (S-IDS). We propose a S-IDS reference architecture and we discuss all the steps through its implementations. Finally, we test the S-IDS on real ICS traffic samples captured from a water treatment and purification facility.

Using Temporal and Topological Features for Intrusion Detection in Operational Networks

“…A summary of the related work is listed in Table 1. There are reviews addressing the chal- Scientific Work Reviews [19,27] Graph-based methods [2,12,13,36,37,41,42] Graph-based and time-sensitive methods [1,45] Machine learning-based [6,14,32] Statistical processes [33,44,48,50] Wavelet analysis [25,31,35] Industrial Intrusion Detection [3,15,18,20,23,28,34,38,39,46] lenge of anomaly detection for intrusion detection. García-Teodoro et al address the challenges of this field of work while presenting techniques and systems [19].…”

“…Legacy systems without inherent security mechanisms have to be addressed [15,18,34], critical states that can have severe effects on the physical world need to be prevented [28] and deterministic behaviour of processes can be leveraged to detect anomalies [23]. Sequences are relatively unifom in industrial applications, this characteristic can be incorporated into an IDS [3]. Tsang and Kwong present an industrial IDS based on the ant colony clustering approach [46].…”

Intrusion Detection for Sequence-Based Attacks with Reduced Traffic Models

“…Alg. 1 l. [1][2][3][4][5][6][7][8][9][10][11][12][13][14], processing its events. S2 extracts the attributes of an event and stores them in variable 'State DT M C ' (c.f.…”

“…We use the same algorithm and thresholds as explained in [12]. The thresholds for both a state violation and transition violation equal 0.1.…”

Intrusion detection in networked control systems : from system knowledge to network security

“…This approach has been tested against three real critical infrastructure facilities over two weeks of normal operations. Part of this chapter has appeared in a refereed conference publication [3] and in a refereed workshop publication [2].…”