Network-based Intrusion Detection Systems for Industrial Control Systems

Examensarbete för masterexamen

Please use this identifier to cite or link to this item: https://hdl.handle.net/20.500.12380/249916
Download file(s):
File Description SizeFormat 
249916.pdfFulltext5.23 MBAdobe PDFView/Open
Type: Examensarbete för masterexamen
Master Thesis
Title: Network-based Intrusion Detection Systems for Industrial Control Systems
Authors: Angséus, Johan
Ekbom, Rikard
Abstract: As Industrial Control Systems (ICSs) become more and more connected it follows that they need to become more secure. Traditional Intrusion Detection Systems (IDSs) do not work well due to the fact that they mostly work on a signature basis and there are not many known signatures to detect attacks on ICSs. Since the network traffic from an ICS is claimed to be static and signatures are scarce, searching for anomalies in the network to detect threats is more effective. This can be achieved using machine learning and other statistical models, teaching the system to tell regular traffic from irregularities. In this thesis we survey papers from related work and evaluate their results, conduct a risk analysis of ICSs from published sources and a workshop with an industry expert. Based on the survey and the risk analysis we analyze over 100 days of network traffic from a water distribution system in order to get further understanding of how ICSs act, both considering network traffic and process semantics. From this work we propose and evaluate three methods to be used when creating a more data driven IDS, capable of detecting process semantic tampering within an ICS. Our results from conducted experiments exhibit a static nature of the data originating from the ICS and the result from evaluating two of the three proposed methods using proof of concept systems, we deem that these anomaly-based detection methods work well for both semantic tampering as well as on a network basis. Having an IDS using a fusion of all three proposed methods, would benefit the security of an ICS since both semantics and network behavior are taken into account.
Keywords: Data- och informationsvetenskap;Computer and Information Science
Issue Date: 2017
Publisher: Chalmers tekniska högskola / Institutionen för data- och informationsteknik (Chalmers)
Chalmers University of Technology / Department of Computer Science and Engineering (Chalmers)
URI: https://hdl.handle.net/20.500.12380/249916
Collection:Examensarbeten för masterexamen // Master Theses



Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.