StreamPipes Connect: Semantics-Based Edge Adapters for the IIoT

Zehnder, Philipp; Wiener, Patrick; Straub, Thomas; Riemer, Dominik

doi:10.1007/978-3-030-49461-2_39

Cited by 5 publications

(3 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A more challenging aspect is the extraction of the actual process values from industrial communication because of their encoding. To this end, the transcribers allow defining custom rules to extract and post-process process values directly from observed communication, similar to StreamPipes [121]. Such rules are small code snippets that allow, e.g., to interpret two 16 bit registers (the biggest data type in Modbus) as a single 32-bit float representing, e.g., a temperature, even if distributed over several packets.…”

Section: Transcribing Industrial Protocolsmentioning

confidence: 99%

“…The problem of protocol heterogeneity in industrial communication is not exclusive to intrusion detection. Proposals to address this issue (e.g., PLC4X [43] and StreamPipes [116,121]) do, however, only extract insufficient information for IIDSs and consume valuable bandwidth through polling, a limited good in many industrial scenarios [17,114]. Other work in this context is concerned with the interoperability of devices [50,67,75,122] and proposes direct translation between different data representations.…”

Section: Further Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Facilitating Protocol-independent Industrial Intrusion Detection Systems

Wolsing

Wagner

Henze

2020

Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

The increasing interconnection of industrial networks with the Internet exposes them to an ever-growing risk of cyberattacks. A well-proven mechanism to detect such attacks is industrial intrusion detection, which searches for anomalies in otherwise predictable communication or process behavior. However, efforts to improve these detection methods mostly focus on specific domains and communication protocols, leading to a research landscape that is broken up into isolated silos. Thus, existing approaches cannot be applied to other industrial scenarios that would equally benefit from powerful detection approaches. To better understand this issue, we survey 53 detection systems and conclude that there is no fundamental reason for their narrow focus. Although they are often coupled to specific industrial protocols in practice, many approaches could generalize to new industrial scenario in theory. To unlock this potential for intrusion detection across industrial domains and protocols, we propose IPAL, our industrial protocol abstraction layer, to decouple intrusion detection from domain-specific industrial communication protocols. We show the practical applicability and correctness of IPAL through a reproducibility study in which we re-implement eight detection approaches from related work on top of IPAL. Finally, we showcase the unique benefits of IPAL for industrial intrusion detection research by studying the generalizability of existing approaches to new datasets and conclude that they are indeed not restricted to specific domains or protocols.

show abstract

Section: Transcribing Industrial Protocolsmentioning

confidence: 99%

Section: Further Related Workmentioning

confidence: 99%

Facilitating Protocol-independent Industrial Intrusion Detection Systems

Wolsing

Wagner

Henze

2020

Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…It is designed to be a self-service analysis tool which allows complex analyses in a big data infrastructure without the need for technical expertise. StreamPipes can compute at least 54,000 events per second on a raspberry Pi (Zehnder et al, 2020), which was deemed acceptable for most use cases. StreamPipes uses a multi-layered technical architecture, shown in Figure 2.…”

Section: Streampipesmentioning

confidence: 99%