Teaching the process of building an Intrusion Detection System using data from a small‐scale SCADA testbed

Abstract

Security of Critical National Infrastructures (CNI) is one of the major concerns to countries both in a European and in a worldwide level. Training on scenarios that involve such systems is important to the effective handling of incidents. This article describes a final year module for teaching traffic anomaly detection to Computer Science and Informatics students at the De Montfort University. Students learn how to combine programming, data mining and security skills in order to build their own Intrusion Detection System using data from a small-scale SCADA testbed.

Down the Rabbit Hole: Fostering Active Learning through Guided Exploration of a SCADA Cyber Range

“…Very often, cyber ranges, cyber security training and simulation platforms are used to support learning activities, giving students the opportunity to participate in realistic scenarios [4], assuming specific roles based on the nature of the exercises (for example, in red/blue team drills). This is true, for example, of the cybersecurity curricula offered at De Montfort University (UK) [5] and Coimbra (PT) Universities [6]. Also within this scope, Trabelsi et al [7] developed a technique for introducing essential concepts such as network keylogging and eavesdropping threats, after considering existing approaches to teaching cybersecurity-related topics.…”

RDTIDS: Rules and Decision Tree-Based Intrusion Detection System for Internet-of-Things Networks

“…Along with other preventive security mechanisms, such as access control and authentication, intrusion detection systems (IDSs) are deployed as a second line of defense. IDSs based on some specific rules or patterns of the normal behavior of the system can distinguish between normal and malicious actions [4,5].…”