Network Anomaly Detection Scheme Based on Running States of Industrial Control System

Abstract

Recently, due to applying standardized technologies and connectivity to the Internet, Industrial Control Systems (ICS) face the threat of cyber attacks. In this paper, we proposed network anomaly detection scheme for ICS to detect cyber attacks for which signatures are not defined. In our proposed scheme, anomaly detection is performed based on the table where running states of ICS and regular communication patterns are matched. We built the ICS testbed and evaluated our proposed scheme. We conducted cyber attacks against the ICS testbed, all the attacks were detected.