Home > Research > Publications & Outputs > SENAMI

Electronic data

  • senami

    Rights statement: © Owner/Author, 2016. This is the author's version of the work. It is posted here for your personal use. Not for redistribution. The definitive Version of Record was published in CPS-SPC '16 Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy http://dx.doi.org/10.1145/2994487.2994496

    Accepted author manuscript, 872 KB, PDF-document

    Available under license: CC BY-NC: Creative Commons Attribution-NonCommercial 4.0 International License

Links

Text available via DOI:

View graph of relations

SENAMI: Selective Non-Invasive Active Monitoring for ICS Intrusion Detection

Research output: Contribution in Book/Report/ProceedingsConference contribution

Published
Publication date28/10/2016
Host publicationCPS-SPC '16 Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy
Place of PublicationNew York
PublisherACM
Pages23-34
Number of pages12
ISBN (Print)9781450345682
<mark>Original language</mark>English
Event2nd ACM Workshop on Cyber-Physical Systems Security and Privacy - Vienna, Austria

Workshop

Workshop2nd ACM Workshop on Cyber-Physical Systems Security and Privacy
Abbreviated titleCPS-SPC '16
CountryAustria
CityVienna
Period28/10/1628/10/16
Internet address

Workshop

Workshop2nd ACM Workshop on Cyber-Physical Systems Security and Privacy
Abbreviated titleCPS-SPC '16
CountryAustria
CityVienna
Period28/10/1628/10/16
Internet address

Abstract

Current intrusion detection systems (IDS) for industrial control systems (ICS) mostly involve the retrofitting of conventional network IDSs, such as SNORT. Such an approach is prone to missing highly targeted and specific attacks against ICS. Where ICS-specific approaches exist, they often rely on passive network monitoring techniques, offering a low cost solution, and avoiding any computational overhead arising from actively polling ICS devices. However, the use of passive approaches alone could fail in the detection of attacks that alter the behaviour of ICS devices (as was the case in Stuxnet). Where active solutions exist, they can be resource-intensive, posing the risk of overloading legacy devices which are commonplace in ICSs. In this paper we aim to overcome these challenges through the combination of a passive network monitoring approach, and selective active monitoring based on attack vectors specific to an ICS context. We present the implementation of our IDS, SENAMI, for use with Siemens S7 devices. We evaluate the effectiveness of SENAMI in a comprehensive testbed environment, demonstrating validity of the proposed approach through the detection of purely passive attacks at a rate of 99%, and active value tampering attacks at a rate of 81-93%. Crucially, we reach recall values greater than 0.96, indicating few attack scenarios generating false negatives.

Bibliographic note

© Owner/Author, 2016. This is the author's version of the work. It is posted here for your personal use. Not for redistribution. The definitive Version of Record was published in CPS-SPC '16 Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy http://dx.doi.org/10.1145/2994487.2994496