Intrusion Detection and Event Monitoring in SCADA Networks
Paul Oman, Matthew Phillips · 2007
This paper describes the implementation of a customized intrusion detection and event monitoring system for a SCADA/sensor testbed. The system raises alerts upon detecting potential unauthorized access and changes in device settings. By markedly increasing the logging of critical network events, the system shows dramatic improvements in both the security and overall auditing capabilities. In addition to its role in securing SCADA networks, the system assists operators in identifying common configuration errors.Keywords: Intrusion detection, real-time monitoring, SCADA networks