Behavior-based Intrusion Detection Approach deployed on a Naval Testbed
Abstract
This paper presents an application of an intrusion detection approach onto a naval physical testbed. The deployed approach is tailored for complex Industrial Control Systems (ICSs). Such systems play a critical role in managing complex industrial processes and ensuring their security against cyber threats is a major concern. Our work concerns Process-Aware Attacks (PAAs) which are sophisticated attacks aiming at disrupting ICS physical processes. The methodology instantiates a specification-based and process-aware Network Intrusion Detection System (NIDS). The specifications are systematically extracted from international and industry standards. In order to be monitored, such specifications are translated into security requirements which are verified during the execution of the system. Our IDS relies on network traffic capture on fieldbuses as well as Ethernet networks. In addition to our previous work, deploying our approach on a realistic naval testbed allows us to demonstrate its extensibility to different environments. Furthermore, the evaluation of our approach shows both its good detection capabilities and scalability.