CoChat
Sign Up
Cited by 12Network Security and Intrusion DetectionSmart Grid Security and ResilienceInformation and Cyber Security

Better safe than sorry: Risk management based on a safety-augmented network intrusion detection system

Open access
Brenner, Bernhard, Hollerer, Siegfried, Bhosale, Pushparaj, Sauter, Thilo, Kastner, Wolfgang, Fabini, Joachim, Zseby, Tanja·2023·IEEE Open Journal of the Industrial Electronics Society
DOI 10.1109/ojies.2023.3297057
Open this paper in CoChat — free accountOpen PDF

Abstract

Interconnected Industrial Control System (ICS) networks based on routable protocols are susceptible to remote attacks similar to classical Information Technology (IT) networks. However, addressing ICS security in an isolated view is dangerous since ICSs have to ensure safety measures for people, processes, and the environment. Safety and security of ICSs are often addressed separately, without considering their important interrelation. Safety measures can violate security policies (e.g., an emergency stop function accessible by anyone); likewise, a security incident can violate safety policies (e.g., by increasing reaction time). In this paper we propose a Network-based Intrusion Detection System (NIDS) with the interrelation between safety and security in mind: It detects security incidents while evaluating possible safety-related consequences of both the detected attack and possible countermeasures.We evaluate our approach with a Proof of Concept (PoC). The alerts generated by the PoC prototype serve as the basis for a risk management strategy proposed in this paper. Our approach provides a basis for safety-aware intrusion detection in smart factories and other cyber-physical systems.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/ojies.2023.3297057

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Brenner et al. [134]'s empirical results show high detection performance for PortScan, DoS, and botnet scenarios, as well as demonstrable mitigation of safety risks; the system further automates the prioritization of responses based on safety impact.

    “Empirical results show high detection performance for PortScan, DoS, and botnet scenarios, as well as demonstrable mitigation of safety risks; the system further automates the prioritization of responses based on safety impact.”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [134]

    Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Ensemble and decision-fusion-based hybrid data studies explicitly combine detectors with heterogeneous inductive biases-tree ensembles, kernel methods, deep sequence models, and state observers-so that cyber-layer traffic anomalies and physical-layer process deviations are jointly reflected in the final decision, improving robustness under noisy hybrid data and nonstationary operating regimes.

    “First, they explicitly combine detectors with heterogeneous inductive biases-tree ensembles, kernel methods, deep sequence models, and state observers-so that cyber-layer traffic anomalies and physical-layer process deviations are jointly reflected in the final decision, improving robustness under noisy hybrid data and nonstationary operating regimes [133-137].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [134]

    Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Many ensemble and decision-fusion frameworks perform decision-level fusion rather than strict feature-level fusion, aggregating per-model outputs via voting schemes or risk evaluation engines; this design simplifies deployment across diverse ICS domains because existing detectors can be reused while the fusion logic is tuned to plant-specific safety and criticality requirements.

    “Second, many frameworks perform decision-level fusion rather than strict feature-level fusion, aggregating per-model outputs via voting schemes or risk evaluation engines; this design simplifies deployment across diverse ICS domains because existing detectors can be reused while the fusion logic is tuned to plant-specific safety and criticality requirements [133-136].”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [134]

    Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Brenner et al. [134]'s system first detects attacks using network traffic and IDS logs, then links these results to safety metrics such as Safety Integrity Level (SIL), operational criticality (OC), and asset value to quantify risk.

    “It first detects attacks using network traffic and IDS logs (cyber-layer data), then links these results to safety metrics such as Safety Integrity Level (SIL), operational criticality (OC), and asset value (physical and operational layer data) to quantify risk.”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [134]

    The Method section describes incident detection followed by threat modeling, and the Concept and Risk Evaluation sections link network-derived alerts to asset information, including SIL and operational criticality, to calculate a risk priority (Risk Evaluation, p. 9). However, the paper describes network traffic as the IDS input and alerts as its output; it does not support using IDS logs as an additional input for attack detection. It also treats asset value as represented by SIL and operational criticality, rather than as a separate metric. (LLM, conf=0.87)

    Experimental — accuracy not yet measured

  • Although Brenner et al. [134] does not perform explicit feature-level fusion, the system implements a decision-level multi-domain fusion model that combines detection outputs with safety indicators, enabling joint assessment of security severity and safety impact.

    “Although explicit feature-level fusion is not performed, the system implements a decision-level multi-domain fusion model that combines detection outputs with safety indicators, enabling joint assessment of security severity and safety impact.”

    From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [134]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

The citation lists haven’t been fetched yet

References 62 · Cited by 12

Research works printed but not linked: 58

  1. F. Schuster, F. M. Kopp, A. Paul, and H. König, "Attack and fault detection in process control communication using unsupervised machine learning," in 2018 IEEE 16th International Conference on Industrial Informatics (INDIN), pp. 433-438. IEEE, 2018.
  2. A. Wasicek, M. D. Pesé, A. Weimerskirch, Y. Burakova, and K. Singh, "Context-aware intrusion detection in automotive control systems," in Proc. 5th ESCAR USA Conf, pp. 21-22, 2017.
  3. D. Tharanga, "Critical review of risk identification techniques," 05 2020.
  4. New York, NY, USA: Association for Computing Machinery, 2022. [Online]. Available: https://doi.org/10.1145/3538969.3543814 · DOI
  5. Koloa, HI, USA: IEEE, 2016.
  6. L. Piètre-Cambacédès and M. Bouissou, "Modeling safety and security interdependencies with bdmp (boolean logic driven markov processes)," in 2010 IEEE International Conference on Systems, Man and Cybernetics, DOI 10.1109/ICSMC.2010.5641922, pp. 2852-2861. Istanbul, Turkey: IEEE, 2010. · DOI
  7. H.-J. Liao, C.-H. R. Lin, Y.-C. Lin, and K.-Y. Tung, "Intrusion detection system: A comprehensive review," Journal of Network and Computer Applications, vol. 36, no. 1, pp. 16-24, 2013.
  8. D. Day and B. Burns, "A performance analysis of snort and suricata network intrusion detection and prevention engines," in Fifth international conference on digital society, Gosier, Guadeloupe, pp. 187-192, 2011.
  9. V. Jyothsna, V. R. Prasad, and K. M. Prasad, "A review of anomaly based intrusion detection systems," International Journal of Computer Applications, vol. 28, no. 7, pp. 26-35, 2011.
  10. A. Carcano, A. Coletta, M. Guglielmi, M. Masera, I. N. Fovino, and A. Trombetta, "A multidimensional critical state analysis for detecting intrusions in scada systems," IEEE Transactions on Industrial Informatics, vol. 7, no. 2, pp. 179-186, 2011.
  11. M. Mantere, M. Sailio, and S. Noponen, "Feature selection for machine learning based anomaly detection in industrial control system networks," in 2012 IEEE International Conference on Green Computing and Commu- nications, pp. 771-774. IEEE, 2012.
  12. K. Stefanidis and A. G. Voyiatzis, "An hmm-based anomaly detection approach for scada systems," in IFIP International Conference on Infor- mation Security Theory and Practice, pp. 85-99. Springer, 2016.
  13. R. Colelli, F. Magri, S. Panzieri, and F. Pascucci, "Anomaly-based intru- sion detection system for cyber-physical system security," pp. 428-434, 2021.
  14. W. Yu, Y. Wang, and L. Song, "A two stage intrusion detection system for industrial control networks based on ethernet/ip," Electronics, vol. 8, no. 12, p. 1545, 2019.
  15. F. Schuster, F. M. Kopp, A. Paul, and H. König, "Attack and fault detection in process control communication using unsupervised machine learning," in 2018 IEEE 16th International Conference on Industrial Informatics (INDIN), pp. 433-438. IEEE, 2018.
  16. R. Bhatia, S. Benno, J. Esteban, T. V. Lakshman, and J. Grogan, "Unsupervised machine learning for network-centric anomaly detection in iot," in Proceedings of the 3rd ACM CoNEXT Workshop on Big DAta, Machine Learning and Artificial Intelligence for Data Communication Networks, ser. Big-DAMA '19, DOI 10.1145/3359992.3366641, p. 42-48. New York, NY, USA: Association for Computing Machinery, 2019. [Online]. Available: https://doi.org/10.1145/3359992.3366641 · DOI
  17. R. R. R. Barbosa, R. Sadre, and A. Pras, "Difficulties in modeling scada traffic: A comparative analysis," in Passive and Active Measurement, N. Taft and F. Ricciato, Eds., pp. 126-135. Berlin, Heidelberg: Springer Berlin Heidelberg, 2012.
  18. F. Schuster, A. Paul, and H. König, "Towards learning normality for anomaly detection in industrial control networks," in Emerging Manage- ment Mechanisms for the Future Internet, G. Doyen, M. Waldburger, P. Čeleda, A. Sperotto, and B. Stiller, Eds., pp. 61-72. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013.
  19. F. Schuster, A. Paul, R. Rietz, and H. Koenig, "Potentials of using one- class svm for detecting protocol-specific anomalies in industrial net- works," in 2015 IEEE Symposium Series on Computational Intelligence, DOI 10.1109/SSCI.2015.22, pp. 83-90. Cape Town, South Africa: IEEE, 2015. · DOI
  20. G. S. Sestito, A. C. Turcato, A. L. Dias, M. S. Rocha, M. M. da Silva, P. Ferrari, and D. Brandao, "A method for anomalies detection in real-time ethernet data traffic applied to profinet," IEEE Transactions on Industrial Informatics, vol. 14, no. 5, pp. 2171-2180, 2017.
  21. K. Krithivasan, S. Pravinraj, S. S. VS et al., "Detection of cyberattacks in industrial control systems using enhanced principal component analysis and hypergraph-based convolution neural network (epca-hg-cnn)," IEEE Transactions on Industry Applications, vol. 56, no. 4, pp. 4394-4404, 2020.
  22. M. R. Monfared and S. M. Fakhrahmad, "Development of intrusion detection in industrial control systems based on deep learning," Iranian Journal of Science and Technology, Transactions of Electrical Engineer- ing, vol. 46, DOI 10.1007/s40998-022-00493-6, pp. 641-651, 2022. · DOI
  23. S. A. Varghese, A. Dehlaghi Ghadim, A. Balador, Z. Alimadadi, and P. Pa- padimitratos, "Digital twin-based intrusion detection for industrial control systems," in 2022 IEEE International Conference on Pervasive Computing and Communications Workshops and other Affiliated Events (PerCom Workshops), DOI 10.1109/PerComWorkshops53856.2022.9767492, pp. 611-617. Pisa, Italy: IEEE, 2022. · DOI · Paper page
  24. J. Goh, S. Adepu, M. Tan, and Z. S. Lee, "Anomaly detection in cyber physical systems using recurrent neural networks," IEEE, pp. 140-145, 2017.
  25. J. Tai, I. Alsmadi, Y. Zhang, and F. Qiao, "Machine learning meth- ods for anomaly detection in industrial control systems," in 2020 IEEE International Conference on Big Data (Big Data), DOI 10.1109/Big- Data50022.2020.9378018, pp. 2333-2339. · DOI
  26. A. Terai, T. Chiba, H. Shintani, S. Kojima, S. Abe, and I. Koshijima, "Intrusion detection using long short-term memory model for industrial control system," International Journal of Safety and Security Engineering, vol. 10, no. 2, pp. 183-189, 2020.
  27. S. Mokhtari, A. Abbaspour, K. K. Yen, and A. Sargolzaei, "A machine learning approach for anomaly detection in industrial control systems based on measurement data," Electronics, vol. 10, no. 4, p. 407, 2021.
  28. L. A. Maglaras and J. Jiang, "Intrusion detection in scada systems using machine learning techniques," in 2014 Science and Information Confer- ence, DOI 10.1109/SAI.2014.6918252, pp. 626-631. London, UK: IEEE, 2014. · DOI
  29. B. Stewart, L. Rosa, L. Maglaras, T. J. Cruz, P. Simões, and H. Jan- icke, "Effect of network architecture changes on ocsvm based intrusion detection system," in Industrial Networks and Intelligent Systems, L. A. Maglaras, H. Janicke, and K. Jones, Eds., pp. 90-100. Cham: Springer International Publishing, 2017.
  30. M. Mantere, M. Sailio, and S. Noponen, "A module for anomaly detection in ics networks," in Proceedings of the 3rd International Conference on High Confidence Networked Systems, ser. HiCoNS '14, DOI 10.1145/2566468.2566478, p. 49-56. New York, NY, USA: Association for Computing Machinery, 2014. [Online]. Available: https://doi.org/10.1145/2566468.2566478 · DOI
  31. P. Schneider and K. Böttinger, "High-performance unsupervised anomaly detection for cyber-physical system networks," in Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, ser. CPS-SPC '18, DOI 10.1145/3264888.3264890, p. 1-12. New York, NY, USA: Association for Computing Machinery, 2018. [Online]. Available: https://doi.org/10.1145/3264888.3264890 · DOI
  32. S. Kim, W. Jo, and T. Shon, "APAD: autoencoder-based payload anomaly detection for industrial ioe," Applied Soft Computing, vol. 88, p. 106017, 2020.
  33. J.-R. Jiang and Y.-T. Chen, "Industrial control system anomaly detection and classification based on network traffic," IEEE Access, vol. 10, pp. 41 874-41 888, 2022.
  34. P. Laskov, P. Düssel, C. Schäfer, and K. Rieck, "Learning intrusion de- tection: Supervised or unsupervised?" in Image Analysis and Processing - ICIAP 2005, F. Roli and S. Vitulano, Eds., pp. 50-57. Berlin, Heidelberg: Springer Berlin Heidelberg, 2005.
  35. R. Mitchell and R. Chen, "Behavior-rule based intrusion detection systems for safety critical smart grid applications," IEEE Transactions on Smart Grid, vol. 4, no. 3, pp. 1254-1263, 2013.
  36. A. Wasicek, M. D. Pesé, A. Weimerskirch, Y. Burakova, and K. Singh, "Context-aware intrusion detection in automotive control systems," in Proc. 5th ESCAR USA Conf, pp. 21-22, 2017.
  37. C. W. Johnson, "Barriers to the use of intrusion detection systems in safety-critical applications," in Computer Safety, Reliability, and Security: 34th International Conference, SAFECOMP 2015, Delft, The Netherlands, September 23-25, 2015, Proceedings 34, pp. 375-384. Springer, 2015.
  38. D. Tharanga, "Critical review of risk identification techniques," 05 2020.
  39. J. Tixier, G. Dusserre, O. Salvi, and D. Gaston, "Review of 62 risk analysis methodologies of industrial plants," Journal of Loss Prevention in the Process Industries, vol. 15, DOI https://doi.org/10.1016/S0950- 4230(02)00008-6, no. 4, pp. 291-303, 2002. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0950423002000086 · DOI
  40. X. Lyu, Y. Ding, and S. Yang, "Safety and security risk assessment in cyber-physical systems," IET Cyber-Physical Systems: Theory & Appli- cations, vol. 4, DOI 10.1049/iet-cps.2018.5068, 09 2019. · DOI
  41. P. Bhosale, W. Kastner, and T. Sauter, "A centralised or distributed risk as- sessment using asset administration shell," in 2021 26th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA ), DOI 10.1109/ETFA45728.2021.9613152, pp. 1-4, 2021. · DOI
  42. T. Abdelghani, "Implementation of defense in depth strategy to secure industrial control system in critical infrastructures," American Journal of Artificial Intelligence, vol. 3, DOI https://doi.org/10.11648/j.ajai.20190302.11, pp. 17-22, 01 2020. · DOI
  43. T. Aven, "Risk assessment and risk management: Review of recent advances on their foundation," European Journal of Operational Research, vol. 253, DOI https://doi.org/10.1016/j.ejor.2015.12.023, no. 1, pp. 1-13, 2016. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0377221715011479 · DOI
  44. W. Kanoun, N. Cuppens-Boulahia, F. Cuppens, and J. Araujo, "Automated reaction based on risk analysis and attackers skills in intrusion detection systems," in 2008 Third International Conference on Risks and Security of Internet and Systems, DOI 10.1109/CRISIS.2008.4757471, pp. 117-124. Tozeur, Tunisia: IEEE, 2008. · DOI
  45. W. Kanoun, N. Cuppens-Boulahia, F. Cuppens, and F. Autrel, "Advanced reaction using risk assessment in intrusion detection systems," in Critical Information Infrastructures Security, pp. 58-70. Berlin, Heidelberg: Springer Berlin Heidelberg, 2008.
  46. A. Shameli-Sendi, M. Cheriet, and A. Hamou-Lhadj, "Taxonomy of intrusion risk assessment and response system," Computers & Security, vol. 45, pp. 1-16, 2014.
  47. G. Vormayr, J. Fabini, and T. Zseby, "Why are my flows different? a tutorial on flow exporters," IEEE Communications Surveys & Tutorials, vol. 22, no. 3, pp. 2064-2103, 2020.
  48. F. Meghdouri, T. Zseby, and F. Iglesias, "Analysis of lightweight feature vectors for attack detection in network traffic," Applied Sciences, vol. 8, no. 11, p. 2196, 2018.
  49. N. Williams, S. Zander, and G. Armitage, "A preliminary performance comparison of five machine learning algorithms for practical ip traffic flow classification," ACM SIGCOMM Computer Communication Review, vol. 36, no. 5, pp. 5-16, 2006.
  50. F. Iglesias and T. Zseby, "Time-activity footprints in ip traffic," Computer Networks, vol. 107, pp. 64-75, 2016.
  51. D. C. Ferreira, F. I. Vázquez, G. Vormayr, M. Bachl, and T. Zseby, "A meta-analysis approach for feature selection in network traffic research," pp. 17-20, 2017.
  52. B. Brenner and E. Weippl, Security Analysis and Improvement of Data Logistics in AutomationML-Based Engineering Networks, pp. 305-334. Cham: Springer International Publishing, 2019. [Online]. Available: https://doi.org/10.1007/978-3-030-25312-7_11 · DOI
  53. S. Hollerer, T. Sauter, and W. Kastner, "Risk assessments considering safety, security, and their interdependencies in ot environments," in Proceedings of the 17th International Conference on Availability, Reliability and Security, ser. ARES '22, DOI 10.1145/3538969.3543814. New York, NY, USA: Association for Computing Machinery, 2022. [Online]. Available: https://doi.org/10.1145/3538969.3543814 · DOI
  54. W. A. Conklin, "It vs. ot security: A time to consider a change in cia to include resilienc," in 2016 49th Hawaii International Conference on System Sciences (HICSS), DOI 10.1109/HICSS.2016.331, pp. 2642- 2647. · DOI
  55. Koloa, HI, USA: IEEE, 2016.
  56. S. Hollerer, W. Kastner, and T. Sauter, "Safety und security-ein span- nungsfeld in der industriellen praxis." Elektrotech. Informationstechnik, vol. 138, no. 7, pp. 449-453, 2021.
  57. P. Bhosale, W. Kastner, and T. Sauter, "Automating safety and security risk assessment in industrial control systems: Challenges and constraints," in 2022 IEEE 27th International Conference on Emerging Technologies and Factory Automation (ETFA), DOI 10.1109/ETFA52439.2022.9921517, pp. 1-4. Stuttgart, Germany: IEEE, 2022. · DOI
  58. IEEE OPEN JOURNAL OF THE INDUSTRIAL ELECTRONICS SOCIETY. VOLUME XX,

Authors
Brenner, B., Hollerer, S., Bhosale, P., Sauter, T., Kastner, W., Fabini, J., & Zseby, T.
Affiliations
  • TU Wien (AT)
  • Institute of Computer Engineering, TU Wien, Vienna, Austria
ORCID
Venue
IEEE Open Journal of the Industrial Electronics Society
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2023
Volume
4
Pages
287-303
ISSN
2644-1284 (ISSN-L)
DOI
10.1109/ojies.2023.3297057
OpenAlex
W4384916669
Cited by
12
References
62
Citations by year
2026: 1 · 2025: 2 · 2024: 8 · 2023: 1
FWCI
1.33
Type
journal article
Language
en
Open access
Licence
Locations
  • IEEE Open Journal of the Industrial Electronics Society (publishedVersion, cc-by-nc-nd)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Funders
TÜV AUSTRIA #safeseclab Research Lab for Safety and Security in Industry
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
Keywords
network intrusion detection, industrial control systems, risk management, safety-critical systems, cyber-physical systems, smart factory, industrial network security

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review