An approach based on behavioral models and critical states distance notion for improving cybersecurity of industrial control systems
Open accessAbstract
Since the beginning of the 21th century, Industrial Control Systems (ICS) have been targeted by hackers. The main motives for the interest to ICS is the ease for performing cyberattacks and the potential damages inflicted to the system and its environment in case of success. The purpose of this paper is to propose an approach for detecting malicious orders in discrete-event system. Four types of attacks (direct, sequential, temporal and over-soliciting) that affect an industrial system are studied in this work. Based on the vulnerabilities in ICS and the positioning of other techniques, an innovative methodology is exposed in this paper to develop detection mechanisms based on the “automation-knowledge”. Thus, by using models of system with an improved notion of distance and trajectory, our filters based approach provides good results for detecting cyberattacks in lower levels of ICS architecture by analyzing the malicious nature of the orders sent. Different types of detection mechanisms based on the concept of distance and trajectory are detailed in this study. We also provide results on simulation examples and an industrial platform. To conclude, improvements of our approach are discussed.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
An innovative methodology was proposed by [13], based on the concept of automation knowledge.
“An innovative methodology was proposed by [13], and is based on the concept of ''automation knowledge''.”
From A Review of Cybersecurity Guidelines for Manufacturing Factories in Industry 4.0 (2021) · cites this paper as [13]
The approach by [13] showed good results for detection of cyberattacks that affect physical systems.
“The author confirmed that the approach showed good results for detection of cyberattacks that affect physical systems.”
From A Review of Cybersecurity Guidelines for Manufacturing Factories in Industry 4.0 (2021) · cites this paper as [13]
The improvement of the approach by [13] was the blockage of orders before leading the system into a critical state, and the detection of sequential attacks using combinational and temporal constraints.
“The improvement was the blockage of the orders before leading the system into a critical state, and the detection of sequential attacks using combinational and temporal constraints.”
From A Review of Cybersecurity Guidelines for Manufacturing Factories in Industry 4.0 (2021) · cites this paper as [13]
Cites
A review of cyber security risk assessment methods for SCADA systems
Cherdantseva, Y., Burnap, P., Blyth, A., Eden, P., Jones, K., Soulsby, H., & Stoddart, K. (2016) · Computers & Security · doi:10.1016/j.cose.2015.09.009 · Cited by 606 · see citing works
A survey of physics-based attack detection in cyber-physical systems
Giraldo, J., Urbina, D., Cardenas, A., Valente, J., Faisal, M., Ruths, J., Tippenhauer, N. O., Sandberg, H., & Candell, R. (2019) · ACM Computing Surveys · doi:10.1145/3203245 · Cited by 535 · see citing works
A survey of approaches combining safety and security for industrial control systems
Kriaa, S., Pietre-Cambacedes, L., Bouissou, M., & Halgand, Y. (2015) · Reliability Engineering & System Safety · doi:10.1016/j.ress.2015.02.008 · Cited by 375 · see citing works
Accurate modeling of modbus/TCP for intrusion detection in SCADA systems
Goldenberg, N., & Wool, A. (2013) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2013.05.001 · Cited by 323 · see citing works
Critical State-Based Filtering System for Securing SCADA Network Protocols
Nai Fovino, I., Coletta, A., Carcano, A., & Masera, M. (2012) · IEEE Transactions on Industrial Electronics · doi:10.1109/tie.2011.2181132 · Cited by 108 · see citing works
False sequential logic attack on SCADA system and its physical impact analysis
Li, W., Xie, L., Deng, Z., & Wang, Z. (2016) · Computers & Security · doi:10.1016/j.cose.2016.01.001 · Cited by 71 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
A Review of Cybersecurity Guidelines for Manufacturing Factories in Industry 4.0
Mullet, V., Sondi, P., & Ramat, E. (2021) · IEEE Access · doi:10.1109/access.2021.3056650 · Cited by 161 · see citing works
“An innovative methodology was proposed by [13], and is based on the concept of ‘‘automation knowledge’’.”
MethodSystematic and Efficient Anomaly Detection Framework using Machine Learning on Public ICS Datasets
Baptiste, M., Julien, F., & Franck, S. (2021) · 2021 IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr51186.2021.9527911 · Cited by 8 · see citing works
- Authors
- SICARD, F., ZAMAI, É., & FLAUS, J.-M.
- Affiliations
- Centre National de la Recherche Scientifique (FR)
- Corresponding author
- SICARD, Franck
- ORCID
- SICARD, Franck
- Venue
- Reliability Engineering & System Safety
- Publisher
- Elsevier BV
- Published
- 2019-08
- Volume
- 188
- Pages
- 584-603
- ISSN
- 0951-8320 (ISSN-L)
- OpenAlex
- W2921035150
- Cited by
- 25
- References
- 6
- Citations by year
- 2026: 1 · 2025: 4 · 2024: 3 · 2023: 1 · 2022: 3 · 2021: 7 · 2020: 4 · 2019: 2
- FWCI
- 2.22
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Reliability Engineering & System Safety (acceptedVersion, other-oa)
- HAL (submittedVersion, cc-by-nc)
- RePEc: Research Papers in Economics (submittedVersion)
- Funders
- Direction Générale de l'Armement (DGA) – Maîtrise de l'information (14810080)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Computational Theory and Mathematics › Petri Nets in System Modeling
- Keywords
- industrial control systems, cyberattack detection, discrete event systems, behavioral models, trajectory analysis, direct attack, sequential attacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
