SENAMI:Selective Non-Invasive Active Monitoring for ICS Intrusion Detection

Jardine, William and Frey, Sylvain and Green, Benjamin and Rashid, Awais (2016) SENAMI:Selective Non-Invasive Active Monitoring for ICS Intrusion Detection. In: CPS-SPC '16 Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy. ACM, AUT, pp. 23-34. ISBN 9781450345682

[thumbnail of senami]
Preview
PDF (senami)
senami.pdf - Accepted Version
Available under License Creative Commons Attribution-NonCommercial.

Download (892kB)

Abstract

Current intrusion detection systems (IDS) for industrial control systems (ICS) mostly involve the retrofitting of conventional network IDSs, such as SNORT. Such an approach is prone to missing highly targeted and specific attacks against ICS. Where ICS-specific approaches exist, they often rely on passive network monitoring techniques, offering a low cost solution, and avoiding any computational overhead arising from actively polling ICS devices. However, the use of passive approaches alone could fail in the detection of attacks that alter the behaviour of ICS devices (as was the case in Stuxnet). Where active solutions exist, they can be resource-intensive, posing the risk of overloading legacy devices which are commonplace in ICSs. In this paper we aim to overcome these challenges through the combination of a passive network monitoring approach, and selective active monitoring based on attack vectors specific to an ICS context. We present the implementation of our IDS, SENAMI, for use with Siemens S7 devices. We evaluate the effectiveness of SENAMI in a comprehensive testbed environment, demonstrating validity of the proposed approach through the detection of purely passive attacks at a rate of 99%, and active value tampering attacks at a rate of 81-93%. Crucially, we reach recall values greater than 0.96, indicating few attack scenarios generating false negatives.

Item Type:
Contribution in Book/Report/Proceedings
Additional Information:
© Owner/Author, 2016. This is the author's version of the work. It is posted here for your personal use. Not for redistribution. The definitive Version of Record was published in CPS-SPC '16 Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy http://dx.doi.org/10.1145/2994487.2994496
ID Code:
81642
Deposited By:
Deposited On:
22 Sep 2016 10:24
Refereed?:
Yes
Published?:
Published
Last Modified:
17 Sep 2023 03:58