A Novel Intrusion Detection Mechanism for SCADA systems which Automatically Adapts to Network Topology Changes

• Published in: EAI endorsed transactions on industrial networks and intelligent systems Vol. 4; no. 10; p. 152155
• Main Authors: Stewart, Barnaby, Rosa, Luis, Maglaras, Leandros A., Cruz, Tiago J., Ferrag, Mohamed Amine, Simoes, Paulo, Janicke, Helge
• Format: Journal Article
• Language: English
• Published: Ghent European Alliance for Innovation (EAI) 01-02-2017
• Subjects: adaptive mechanisms; Control systems; Industrial applications; Industrial electronics; Intrusion detection systems; Network topologies; Security; Supervisory control and data acquisition; Support vector machines
• ISSN: 2410-0218; 2410-0218
• DOI: 10.4108/eai.1-2-2017.152155

Industrial Control Systems (ICS) are getting more vulnerable as they become increasingly interconnected with other systems. Industrial Internet of Things(IIoT) will bring new opportunities to business and society, along with new threats and security risks. One major change that ICS will face will be that of the dynamic network topology. Changes in the network architecture will affect the performance of the ICS along with the efficiency of the security mechanisms that are deployed. The current article investigates how changes in the network architecture of a supervisory control and data acquisition (SCADA) system affect the performance of an Intrusion Detection System IDS that is based on the One class Support Vector Machine (OCSVM). Also the article proposes an adaptive mechanism that can cope with such changes and can work in real time situations. The performance of the proposed adaptive IDS is tested using traces from a Hybrid ICS testbed with a dynamic topology.