IDEAS home Printed from https://ideas.repec.org/a/eee/reensy/v225y2022ics0951832022002186.html
   My bibliography  Save this article

Model-based IDS design for ICSs

Author

Listed:
  • Monzer, Mohamad-Houssein
  • Beydoun, Kamal
  • Ghaith, Alaa
  • Flaus, Jean-Marie

Abstract

Industrial systems present security risk factors related to their cyber vulnerabilities. These systems spread out over the world, continue to be targets of attacks. While industrial systems share common vulnerabilities with Information Technology (IT) systems, they tend to have more constraints due to the interaction between cyber and physical systems. Intrusion detection systems give visibility to the system and are considered to be one of the solutions to detect targeting attacks. Hence, it seems relevant to rely on a physical model of the cyber–physical system to obtain an intrusion detection system (IDS) for industrial systems. Most IDSs are based on rules that define how potential attacks are detected. These rules are generally used to describe either the normal system behavior or potential attack scenarios. However, manually creating and maintaining rules for a complex Cyber–Physical system or ICS can prove to be a very tedious and difficult task. This paper proposes a solution to model ICSs and design specific IDSs for ICSs. A model-based IDS rules generator is proposed, which converts a system model into anomaly-based IDS rules. Finally, the effectiveness of the generated rules is evaluated.

Suggested Citation

  • Monzer, Mohamad-Houssein & Beydoun, Kamal & Ghaith, Alaa & Flaus, Jean-Marie, 2022. "Model-based IDS design for ICSs," Reliability Engineering and System Safety, Elsevier, vol. 225(C).
    • Handle: RePEc:eee:reensy:v:225:y:2022:i:c:s0951832022002186
    DOI: 10.1016/j.ress.2022.108571
    as

    Download full text from publisher

    File URL: http://www.sciencedirect.com/science/article/pii/S0951832022002186
    Download Restriction: Full text for ScienceDirect subscribers only
    File URL: https://libkey.io/10.1016/j.ress.2022.108571?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    As the access to this document is restricted, you may want to search for a different version of it.

    References listed on IDEAS

    as
    1. Basnight, Zachry & Butts, Jonathan & Lopez, Juan & Dube, Thomas, 2013. "Firmware modification attacks on programmable logic controllers," International Journal of Critical Infrastructure Protection, Elsevier, vol. 6(2), pages 76-84.
    2. Shin, Jinsoo & Son, Hanseong & Khalil ur, Rahman & Heo, Gyunyoung, 2015. "Development of a cyber security risk model using Bayesian networks," Reliability Engineering and System Safety, Elsevier, vol. 134(C), pages 208-217.
    3. Barbosa, Rafael Ramos Regis & Sadre, Ramin & Pras, Aiko, 2013. "Flow whitelisting in SCADA networks," International Journal of Critical Infrastructure Protection, Elsevier, vol. 6(3), pages 150-158.
    4. SICARD, Franck & ZAMAI, Éric & FLAUS, Jean-Marie, 2019. "An approach based on behavioral models and critical states distance notion for improving cybersecurity of industrial control systems," Reliability Engineering and System Safety, Elsevier, vol. 188(C), pages 584-603.
    5. Huitsing, Peter & Chandia, Rodrigo & Papa, Mauricio & Shenoi, Sujeet, 2008. "Attack taxonomies for the Modbus protocols," International Journal of Critical Infrastructure Protection, Elsevier, vol. 1(C), pages 37-44.
    6. Schuett, Carl & Butts, Jonathan & Dunlap, Stephen, 2014. "An evaluation of modification attacks on programmable logic controllers," International Journal of Critical Infrastructure Protection, Elsevier, vol. 7(1), pages 61-68.
    7. Zang, Tianlei & Gao, Shibin & Liu, Baoxu & Huang, Tao & Wang, Tao & Wei, Xiaoguang, 2019. "Integrated fault propagation model based vulnerability assessment of the electrical cyber-physical system under cyber attacks," Reliability Engineering and System Safety, Elsevier, vol. 189(C), pages 232-241.
    8. Chatterjee, Samrat & Thekdi, Shital, 2020. "An iterative learning and inference approach to managing dynamic cyber vulnerabilities of complex systems," Reliability Engineering and System Safety, Elsevier, vol. 193(C).
    Full references (including those not matched with items on IDEAS)

    Citations

    Citations are extracted by the CitEc Project, subscribe to its RSS feed for this item.
    as


    Cited by:

    1. Yuan, Shuaiqi & Reniers, Genserik & Yang, Ming, 2024. "Integrated management of safety and security barriers in chemical plants to cope with emerging cyber-physical attack risks under uncertainties," Reliability Engineering and System Safety, Elsevier, vol. 250(C).
    2. Yin, Zhenqin & Zhuo, Yue & Ge, Zhiqiang, 2023. "Transfer adversarial attacks across industrial intelligent systems," Reliability Engineering and System Safety, Elsevier, vol. 237(C).

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Safari, Mohammad & Parvinnia, Elham & Haddad, Alireza Keshavarz, 2021. "Industrial intrusion detection based on the behavior of rotating machine," International Journal of Critical Infrastructure Protection, Elsevier, vol. 34(C).
    2. Wang, Wei & Cova, Gregorio & Zio, Enrico, 2022. "A clustering-based framework for searching vulnerabilities in the operation dynamics of Cyber-Physical Energy Systems," Reliability Engineering and System Safety, Elsevier, vol. 222(C).
    3. Gopal Vishwakarma & Wonjun Lee, 2018. "Exploiting JTAG and Its Mitigation in IOT: A Survey," Future Internet, MDPI, vol. 10(12), pages 1-18, December.
    4. SICARD, Franck & ZAMAI, Éric & FLAUS, Jean-Marie, 2019. "An approach based on behavioral models and critical states distance notion for improving cybersecurity of industrial control systems," Reliability Engineering and System Safety, Elsevier, vol. 188(C), pages 584-603.
    5. Yadav, Geeta & Paul, Kolin, 2021. "Architecture and security of SCADA systems: A review," International Journal of Critical Infrastructure Protection, Elsevier, vol. 34(C).
    6. Zhu, Ruijin & Zhang, Baofeng & Mao, Junjie & Zhang, Quanxin & Tan, Yu-an, 2017. "A methodology for determining the image base of ARM-based industrial control system firmware," International Journal of Critical Infrastructure Protection, Elsevier, vol. 16(C), pages 26-35.
    7. Ghaleb, Asem & Zhioua, Sami & Almulhem, Ahmad, 2018. "On PLC network security," International Journal of Critical Infrastructure Protection, Elsevier, vol. 22(C), pages 62-69.
    8. Rodofile, Nicholas R. & Radke, Kenneth & Foo, Ernest, 2019. "Extending the cyber-attack landscape for SCADA-based critical infrastructure," International Journal of Critical Infrastructure Protection, Elsevier, vol. 25(C), pages 14-35.
    9. Kim, Hee Eun & Son, Han Seong & Kim, Jonghyun & Kang, Hyun Gook, 2017. "Systematic development of scenarios caused by cyber-attack-induced human errors in nuclear power plants," Reliability Engineering and System Safety, Elsevier, vol. 167(C), pages 290-301.
    10. Zio, E., 2018. "The future of risk assessment," Reliability Engineering and System Safety, Elsevier, vol. 177(C), pages 176-190.
    11. Fu, Xiuwen & Wang, Ye & Yang, Yongsheng & Postolache, Octavian, 2022. "Analysis on cascading reliability of edge-assisted Internet of Things," Reliability Engineering and System Safety, Elsevier, vol. 223(C).
    12. Rahman, Ayesha & Mustafa, Ghulam & Khan, Abdul Qayyum & Abid, Muhammad & Durad, Muhammad Hanif, 2022. "Launch of denial of service attacks on the modbus/TCP protocol and development of its protection mechanisms," International Journal of Critical Infrastructure Protection, Elsevier, vol. 39(C).
    13. Konstantinos Ntafloukas & Liliana Pasquale & Beatriz Martinez-Pastor & Daniel P. McCrum, 2023. "A Vulnerability Assessment Approach for Transportation Networks Subjected to Cyber–Physical Attacks," Future Internet, MDPI, vol. 15(3), pages 1-23, February.
    14. Shuai Lin & Limin Jia & Hengrun Zhang & Yanhui Wang, 2021. "A method for assessing resilience of high-speed EMUs considering a network-based system topology and performance data," Journal of Risk and Reliability, , vol. 235(5), pages 877-895, October.
    15. Gao, Xingle & Peng, Minfang & Zhang, Ji & Shao, Hua & Liu, Yanchen, 2024. "A cascading failure model of cyber-coupled power system considering virus propagation," Physica A: Statistical Mechanics and its Applications, Elsevier, vol. 636(C).
    16. Schuett, Carl & Butts, Jonathan & Dunlap, Stephen, 2014. "An evaluation of modification attacks on programmable logic controllers," International Journal of Critical Infrastructure Protection, Elsevier, vol. 7(1), pages 61-68.
    17. Genge, Béla & Graur, Flavius & Haller, Piroska, 2015. "Experimental assessment of network design approaches for protecting industrial control systems," International Journal of Critical Infrastructure Protection, Elsevier, vol. 11(C), pages 24-38.
    18. Krotofil, Marina & Cárdenas, Alvaro & Larsen, Jason & Gollmann, Dieter, 2014. "Vulnerabilities of cyber-physical systems to stale data—Determining the optimal time to launch attacks," International Journal of Critical Infrastructure Protection, Elsevier, vol. 7(4), pages 213-232.
    19. Jarmakiewicz, Jacek & Parobczak, Krzysztof & Maślanka, Krzysztof, 2017. "Cybersecurity protection for power grid control infrastructures," International Journal of Critical Infrastructure Protection, Elsevier, vol. 18(C), pages 20-33.
    20. Nai Fovino, Igor & Carcano, Andrea & Masera, Marcelo & Trombetta, Alberto, 2009. "An experimental investigation of malware attacks on SCADA systems," International Journal of Critical Infrastructure Protection, Elsevier, vol. 2(4), pages 139-145.

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:eee:reensy:v:225:y:2022:i:c:s0951832022002186. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: Catherine Liu (email available below). General contact details of provider: https://www.journals.elsevier.com/reliability-engineering-and-system-safety .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.