SCADA Intrusion Detection System based on temporal behavior of frequent patterns
Naoum Sayegh, Imad H. Elhajj, Ayman Kayssi, Ali Chehab · 2014
The vital role Supervisory Control And Data Acquisition (SCADA) systems play in controlling the modern infrastructure; along with the rapid evolution of these systems have turned them into one of the most desired targets for malicious attackers. Moreover, SCADA-specific attacks are becoming more sophisticated, and yet security measures are deployed at a very slow pace. In this work, we present a SCADA-specific Intrusion Detection System (IDS) that detects SCADA attacks based on their network traffic behavior, namely the temporal behavior of frequent patterns of the SCADA protocols. The IDS raises alarms when abnormal behavior is identified. The results showed that the IDS is able to detect attacks at a high rate while keeping false alarms at a minimum rate.