Generating abnormal industrial control network traffic for intrusion detection system testing - Song, Joo Yeop; Lee, Woomyo; Yun, Jeong Han; Park, Hyunjae; Kim, Sin Kyu; Choi, Young June (IFIP Advances in Information and Communication Technology, 2018)
Industrial control systems are widely used across the critical infrastructure sectors. Anomaly-based intrusion detection is an attractive approach for identifying potential attacks that leverage industrial control systems to target critical infrastructure assets. In order to analyze the performance of an anomaly-based intrusion detection system, extensive testing should be performed by considering variations of specific cyber threat scenarios, including victims, attack timing, traffic volume and transmitted contents. However, due to security concerns and the potential impact on operations, it is very difficult, if not impossible, to collect abnormal network traffic from real-world industrial control systems. This chapter addresses the problem by proposing a method for automatically generating a variety of anomalous test traffic based on cyber threat scenarios related to industrial control systems.
Keywords: Anomaly based intrusion detection systems; Anomaly detection; Anomaly-based intrusion detection; Extensive testing; Industrial control systems; Industrial controls; Intrusion Detection Systems; Traffic generation; Anomaly detection; Industrial control systems; Traffic generation