Exploiting the temporal behavior of state transitions for intrusion detection in ICS/SCADA

Prediction-residual-oriented methods are powerful for detecting subtle and coordinated process anomalies, including multi-point stealthy attacks that forge SCADA histories or slowly drive the system toward unsafe states.

“Third, in terms of detection capability and failure modes, the results indicate that prediction-residual-oriented methods are powerful for detecting subtle and coordinated process anomalies, including multi-point stealthy attacks that forge SCADA histories or slowly drive the system toward unsafe states [69,72,73,75,76].”

Process data are particularly suitable for attacks that perturb the physical process state while keeping network-level statistics relatively unchanged, such as false data injection, malicious command or parameter manipulation, process-oriented attacks, and stealthy drifts in sensor trajectories.

“First, process data are particularly suitable for attacks that perturb the physical process state while keeping network-level statistics relatively unchanged-such as false data injection, malicious command or parameter manipulation, process-oriented attacks, and stealthy drifts in sensor trajectories [67,69-73,75,76].”

Studies that explicitly model multiple normal modes or use probabilistic residuals address operating-mode changes by representing them and assigning anomaly scores based on deviation probabilities.

“Studies that explicitly model multiple normal modes or use probabilistic residuals address this by representing operating-mode changes and assigning anomaly scores based on deviation probabilities [70,75].”

The distribution of datasets shows a strong reliance on SWaT and WADI for benchmarking prediction-residual-based methods, with additional evidence from custom-built avionics, robotics, temperature-control, offshore wind farm, and simulation-based CPS testbeds.

“Finally, the distribution of datasets shows a strong reliance on SWaT and WADI for benchmarking prediction-residual-based methods, with additional evidence from custombuilt avionics, robotics, temperature-control, offshore wind farm, and simulation-based CPS testbeds [67-73,75,76].”

In many works, a model predicts the next-step sensor or control-signal values and computes prediction residuals, or derives an anomaly score that functions as a probabilistic or density-based residual, so that small but systematic deviations in process dynamics can be detected even when they are not visible at the network layer.

“In many of these works, a model predicts the next-step sensor or control-signal values and computes prediction residuals, or derives an anomaly score that functions as a probabilistic or density-based residual, so that small but systematic deviations in process dynamics can be detected even when they are not visible at the network layer [67,69,70,72,73,75].”

T-IDS detects not only conventional attacks but also stealthy attacks that gradually delay or freeze processes without explicitly violating invariants.

“In this way, it detects not only conventional attacks but also stealthy attacks that gradually delay or freeze processes without explicitly violating invariants.”

Kabasele Ndonda and Sadre [75] proposed T-IDS, a time-based intrusion detection system that uses transition time and mean update step as features, using process-variable time-series data from SWaT and ICS/SCADA simulations.

“Using process-variable time-series data obtained from the SWaT process and from ICS/SCADA simulations, Kabasele Ndonda and Sadre [75] proposed T-IDS, a time-based intrusion detection system that uses transition time-the time it takes for sensor values to move between threshold regions-and mean update step as features.”