This file was created by the TYPO3 extension bib --- Timezone: CEST Creation date: 2024-09-15 Creation time: 16-06-23 --- Number of references 3 inproceedings 2022-kunze-coin-transport 2022 11 https://www.comsys.rwth-aachen.de/fileadmin/papers/2022/2022-kunze-coin-transport.pdf Proceedings of the 1st Workshop on New IP and Beyond, co-located with the 30th IEEE International Conference on Network Protocols Lexington, Kentucky, USA 1st Workshop on New IP and Beyond, co-located with the 30th IEEE International Conference on Network Protocols 30 October, 2022 10.1109/ICNP55882.2022.9940379 1 IkeKunze DirkTrossen KlausWehrle inproceedings 2022-wolsing-simple 2022 9 978-3-031-17143-7 574--594 Cyberattacks against industrial control systems pose a serious risk to the safety of humans and the environment. Industrial intrusion detection systems oppose this threat by continuously monitoring industrial processes and alerting any deviations from learned normal behavior. To this end, various streams of research rely on advanced and complex approaches, i.e., artificial neural networks, thus achieving allegedly high detection rates. However, as we show in an analysis of 70 approaches from related work, their inherent complexity comes with undesired properties. For example, they exhibit incomprehensible alarms and models only specialized personnel can understand, thus limiting their broad applicability in a heterogeneous industrial domain. Consequentially, we ask whether industrial intrusion detection indeed has to be complex or can be SIMPLE instead, i.e., Sufficient to detect most attacks, Independent of hyperparameters to dial-in, Meaningful in model and alerts, Portable to other industrial domains, Local to a part of the physical process, and computationally Efficient. To answer this question, we propose our design of four SIMPLE industrial intrusion detection systems, such as simple tests for the minima and maxima of process values or the rate at which process values change. Our evaluation of these SIMPLE approaches on four state-of-the-art industrial security datasets reveals that SIMPLE approaches can perform on par with existing complex approaches from related work while simultaneously being comprehensible and easily portable to other scenarios. Thus, it is indeed justified to raise the question of whether industrial intrusion detection needs to be inherently complex. https://www.comsys.rwth-aachen.de/fileadmin/papers/2022/2022-wolsing-simple.pdf Atluri, Vijayalakshmi and Di Pietro, Roberto and Jensen, Christian D. and Meng, Weizhi Springer Nature Switzerland Proceedings of the 27th European Symposium on Research in Computer Security (ESORICS '22), September 26-30, 2022, Copenhagen, Denmark Copenhagen, Denmark 27th European Symposium on Research in Computer Security (ESORICS) September 26-30, 2022 10.1007/978-3-031-17143-7_28 1 KonradWolsing LeaThiemt Christianvan Sloun EricWagner KlausWehrle MartinHenze techreport draft-irtf-coinrg-use-cases-02 2022 3 draft-irtf-coinrg-use-cases-02 expires: 8 September 2022 (work in progress) https://www.comsys.rwth-aachen.de/fileadmin/papers/2022/draft-irtf-coinrg-use-cases-02.pdf https://datatracker.ietf.org/doc/draft-irtf-coinrg-use-cases/ Online IETF Trust Internet Drafts Internet Engineering Task Force Internet Engineering Task Force IkeKunze KlausWehrle DirkTrossen Marie-JoséMontpetit Xavierde Foy DavidGriffin MiguelRio