Intrusion Detection in Industrial Control Systems

Colbert, E. J. M.; Hutchinson, Steve

doi:10.1007/978-3-319-32125-7_11

Cited by 23 publications

(28 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Such attacks can be detected by comparing the observed and expected process values in real time. Once the deviation exceeds a predefined threshold significantly, an alarm is raised [43]. Hadžiosmanović et al [44] classified process variables into three categories: constants, enumeration, and continuous variables.…”

Section: Intrusion Detection Based On Process Data Analysismentioning

confidence: 99%

Detecting stealthy attacks against industrial control systems based on residual skewness analysis

Yang³

et al. 2019

J Wireless Com Network

View full text Add to dashboard Cite

With the integration of the modern industrial control systems (ICS) with the Internet technology, ICS can make full use of the rich resources on the Internet to facilitate remote process control. However, every coin has two sides. More exposure to the outside IT world has made ICS an attractive target for hackers, so it becomes urgent to protect the security of ICS. Skilled attackers can penetrate control networks and then manipulate sensor readings or control signals persistently until the system crashes, while still keeping themselves undetected by following the expected behavior of the system closely. This kind of attacks are referred to as stealthy attacks. As far as we know, many existing intrusion detection techniques only investigate the magnitudes of behavior residuals, so they cannot detect this kind of stealthy attacks. In this paper, we discover that residuals generated during stealthy attacks exhibit significant skewness compared to attack-free residuals. Based on the new observation, we propose an effective and fast technique to detect stealthy attacks against ICS based on residual skewness analysis. Skewness coefficients can distinguish the counterfeited residuals from the attack-free residuals effectively. A larger absolute value of the skewness coefficient generally indicates the occurrence of a more intense stealthy attack. Finally, we conduct comprehensive experiments to verify the effectiveness and efficiency of the proposed stealthy attack detection approach.

show abstract

Section: Intrusion Detection Based On Process Data Analysismentioning

confidence: 99%

Detecting stealthy attacks against industrial control systems based on residual skewness analysis

Yang³

et al. 2019

J Wireless Com Network

View full text Add to dashboard Cite

show abstract

“…al. outline a process-oriented method for intrusion detection by exploiting domain knowledge of control system operators and focusing on the "critical process variables" of the industrial process [34]. Colbert, et.…”

Section: Accepted Manuscriptmentioning

confidence: 99%

“…al. define critical process variables as variables important to the industrial process operation, such as a sensor monitoring temperature of a device [34]. By working with the domain experts of the ICS and network security engineers, ranges of acceptable and critical values are defined and applied to the sensors being monitored.…”

Section: Accepted Manuscriptmentioning

confidence: 99%

Anomaly detection for industrial control systems using process mining

Myers

Suriadi

Radke

et al. 2018

Computers & Security

View full text Add to dashboard Cite

Industrial control systems (ICS) are moving from dedicated communications to switched and routed corporate networks, exposing them to the Internet and placing them at risk of cyber-attacks. Existing methods of detecting cyberattacks, such as intrusion detection systems (IDSs), are commonly implemented in ICS and SCADA networks. However, these devices do not detect more complex threats that manifest themselves gradually over a period of time through a combination of unusual sequencing of activities, such as process-related attacks. During the normal operation of ICSs, ICS devices record device logs, capturing their industrial processes over time. These logs are a rich source of information that should be analysed in order to detect such process-related attacks. In this paper, we present a novel process mining anomaly detection method for identifying anomalous behaviour and cyber-attacks using ICS data logs and the conformance checking analysis technique from the process mining discipline. A conformance checking analysis uses logs captured from production systems with a process model (which captures the expected behaviours of a system) to determine the extent to which real behaviours (captured in the logs) matches the expected behaviours (captured in the process model). The contributions of this paper include an experimentally derived recommendation for logging practices on ICS devices, for the purpose of process miningbased analysis; a formalised approach for pre-processing and transforming device logs from ICS systems into event logs suitable for process mining analysis; guidance on how to create a process model for ICSs and how to apply the created process model through a conformance checking analysis to identify anomalous behaviours. Our anomaly detection method has been successfully applied in detecting ICS cyber-attacks, which the widely used IDS Snort does not detect, using logs derived from industry standard ICS devices.

show abstract

“…However, little work has been done on integrating this information in intrusion detection systems. Colbert et al [2] have developed a process-oriented method for intrusion detection in industrial control systems. Data from critical elements in a physical system are collected by sensors and used to estimate the system state.…”

Section: Related Workmentioning

confidence: 99%

Detecting Data Manipulation Attacks on the Substation Interlocking Function Using Direct Power Feedback

Tebekaemi

Colbert

Wijesekera

2017

Critical Infrastructure Protection XI

View full text Add to dashboard Cite

Any form of deliberate physical or cyber activity that attempts to undermine the control mechanisms that maintain the key goals of reliability, efficiency and safety of a physical system can be considered to be an attack on the system. Indeed, an attack can be as subtle as a configuration change that prevents the optimal operation of a power system.This chapter describes an approach that enhances the security of the interlocking function in a power distribution substation by using the power flow behavior of the physical system during switching events as direct power feedback. The approach detects potential over-thenetwork data modification attacks on the interlocking function using out-of-bounds sensor measurements. The direct power feedback adds an extra layer of security and redundancy to existing power substation interlocking function protection mechanisms.

show abstract

Intrusion Detection in Industrial Control Systems

Cited by 23 publications

References 12 publications

Detecting stealthy attacks against industrial control systems based on residual skewness analysis

Detecting stealthy attacks against industrial control systems based on residual skewness analysis

Anomaly detection for industrial control systems using process mining

Detecting Data Manipulation Attacks on the Substation Interlocking Function Using Direct Power Feedback

Contact Info

Product

Resources

About