A Multidimensional Critical State Analysis for Detecting Intrusions in SCADA Systems
Abstract
A relatively new trend in Critical Infrastructures (e.g., power plants, nuclear plants, energy grids, etc.) is the massive migration from the classic model of isolated systems, to a system-of-systems model, where these infrastructures are intensifying their interconnections through Information and Communications Technology (ICT) means. The ICT core of these industrial installations is known as Supervisory Control And Data Acquisition Systems (SCADA). Traditional ICT security countermeasures (e.g., classic firewalls, anti-viruses and IDSs) fail in providing a complete protection to these systems since their needs are different from those of traditional ICT. This paper presents an innovative approach to Intrusion Detection in SCADA systems based on the concept of Critical State Analysis and State Proximity. The theoretical framework is supported by tests conducted with an Intrusion Detection System prototype implementing the proposed detection approach.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
SCADA systems run over conventional operating systems and thus inherit vulnerabilities that can compromise the SCADA system.
“SCADA systems run over conventional operating systems (OS), thus inheriting vulnerabilities which can compromise the SCADA system [10].”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [10]
Most SCADA systems remain in operation from eight to fifteen years.
“The installation of SCADA systems is costly and time-consuming and most systems remain in operation from eight to fifteen years [10].”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [10]
The attack in 2000 on a sewage control system in Queensland, Australia, causing flooding with a million litres of sewage, was an act of a disgruntled employee.
“The attack in 2000 on a sewage control system in Queensland, Australia [10], [42] causing flooding with a million litres of sewage, was an act of a disgruntled employee.”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [10]
Application of a software update resulted in automatic shutdown of a nuclear plant.
“Application of a software update resulted in automatic shutdown of a nuclear plant [10].”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [10]
Stuxnet infiltrated the network mainly through USB sticks.
“Stuxnet infiltrated the network [10], [16] mainly through USB sticks.”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [10]
There is generally a time lag for patch application; for instance, Slammer infections occurred six months after the patch to fix the vulnerability had been released.
“There is generally a time lag for patch application, for instance, Slammer infections occurred six months after the patch to fix the vulnerability had been released [10].”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [10]
The Aurora Generator Test in March 2007 simulated a remote cyber-attack resulting in destruction of a $1 million diesel-electric generator.
“Aurora Generator Test” [1], [10] in March 2007, simulated a remote cyber-attack resulting in destruction of a $1 million dollar diesel-electric generator [40].”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [10]
Cited by
Sorted by citations
A survey of intrusion detection techniques for cyber-physical systems
Mitchell, R., & Chen, I.-R. (2014) · ACM Computing Surveys · doi:10.1145/2542049 · Cited by 768 · see citing works
A survey of physics-based attack detection in cyber-physical systems
Giraldo, J., Urbina, D., Cardenas, A., Valente, J., Faisal, M., Ruths, J., Tippenhauer, N. O., Sandberg, H., & Candell, R. (2019) · ACM Computing Surveys · doi:10.1145/3203245 · Cited by 535 · see citing works
Review of security issues in industrial networks
Cheminod, M., Durante, L., & Valenzano, A. (2013) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2012.2198666 · Cited by 349 · see citing works
A survey of cyber security management in industrial control systems
Knowles, W., Prince, D., Hutchison, D., Disso, J. F. P., & Jones, K. (2015) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2015.02.002 · Cited by 344 · see citing works
A Survey on SCADA Systems: Secure Protocols, Incidents, Threats and Tactics
Pliatsios, D., Sarigiannidis, P., Lagkas, T., & Sarigiannidis, A. G. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.2987688 · Cited by 320 · see citing works
“Authors in [88] proposed an attack detection approach based on Critical State Analysis.”
MethodA survey of intrusion detection on industrial control systems
Hu, Y., Yang, A., Li, H., Sun, Y., & Sun, L. (2018) · International Journal of Distributed Sensor Networks · doi:10.1177/1550147718794615 · Cited by 185 · see citing works
Pan, S., Morris, T., & Adhikari, U. (2015) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2015.2420951 · Cited by 180 · see citing works
Assessing and augmenting SCADA cyber security: A survey of techniques
Nazir, S., Patel, S., & Patel, D. (2017) · Computers & Security · doi:10.1016/j.cose.2017.06.010 · Cited by 167 · see citing works
“IDS based on critical state analysis in a power plant are proposed by Carcano et al. [108].”
MethodA Review of Cybersecurity Guidelines for Manufacturing Factories in Industry 4.0
Mullet, V., Sondi, P., & Ramat, E. (2021) · IEEE Access · doi:10.1109/access.2021.3056650 · Cited by 161 · see citing works
“The notion of ‘‘distance’’ is related to the ICS states, and was introduced in [43].”
BackgroundHao, W., Yang, T., & Yang, Q. (2023) · IEEE Transactions on Automation Science and Engineering · doi:10.1109/tase.2021.3073396 · Cited by 143 · see citing works
Nader, P., Honeine, P., & Beauseroy, P. (2014) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2014.2330796 · Cited by 122 · see citing works
An unsupervised anomaly-based detection approach for integrity attacks on SCADA systems
Almalawi, A., Yu, X., Tari, Z., Fahad, A., & Khalil, I. (2014) · Computers & Security · doi:10.1016/j.cose.2014.07.005 · Cited by 113 · see citing works
False sequential logic attack on SCADA system and its physical impact analysis
Li, W., Xie, L., Deng, Z., & Wang, Z. (2016) · Computers & Security · doi:10.1016/j.cose.2016.01.001 · Cited by 71 · see citing works
Experimental assessment of network design approaches for protecting industrial control systems
Genge, B., Graur, F., & Haller, P. (2015) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2015.07.005 · Cited by 36 · see citing works
Exploiting the temporal behavior of state transitions for intrusion detection in ICS/SCADA
Kabasele Ndonda, G., & Sadre, R. (2022) · IEEE Access · doi:10.1109/access.2022.3213080 · Cited by 8 · see citing works
- Authors
- Carcano, A., Coletta, A., Guglielmi, M., Masera, M., Nai Fovino, I., & Trombetta, A.
- Affiliations
- University of Insubria (IT)
- Joint Research Centre (IT)
- Venue
- IEEE Transactions on Industrial Informatics
- Published
- 2011-05
- Volume
- 7
- Issue
- 2
- Pages
- 179-186
- ISSN
- 1551-3203 (ISSN-L)
- 1941-0050
- OpenAlex
- W2141050228
- Cited by
- 259
- References
- 0
- Citations by year
- 2026: 8 · 2025: 6 · 2024: 9 · 2023: 10 · 2022: 14 · 2021: 15 · 2020: 25 · 2019: 27 · 2018: 31 · 2017: 18 · 2016: 25 · 2015: 25 · 2014: 20 · 2013: 13 · 2012: 8
- FWCI
- 23.44
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- IEEE Transactions on Industrial Informatics (publishedVersion)
- IrInSubria (University of Insubria) (submittedVersion)
- Joint Research Centre (European Commission) (submittedVersion)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
- Keywords
- SCADA systems, intrusion detection, critical infrastructure security, industrial control systems, systems of systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
