Abnormal detection method of industrial control system based on behavior model. Issue 84 (July 2019)

• Record Type: Journal Article
• Authors: Zhanwei, Song; Zenghui, Liu
• Is Part Of: Computers & security. Issue 84(2019)
• Page Start: 166
• Page End: 178
• Publication Date: 2019-07
• Subjects: Abnormal detection -- Behavior model -- Industrial control systems -- Modbus/TCP -- Network security; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2019.03.009
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: In the field of industrial control systems (ICSs), a broad application background and the different characteristics of a system determine the diversity and particularity of an intrusion detection system. We propose an abnormal detection method based on a behavior model. The method extracts behavior data sequences from industrial control network traffic, builds a normal behavior model of the controller and the controlled process of an ICS, and compares tested behavior data and prediction behavior data to detect any exceptions. According to experimental results, our method can effectively detect abnormal behavior data and control program manipulation attacks.