# Host-based Intrusion Detection for Industrial Control Systems

Omayma Alla, Stéphane Mocanu

► To cite this version:

Omayma Alla, Stéphane Mocanu. Host-based Intrusion Detection for Industrial Control Systems. NetSoft 2025 - 11th IEEE International Conference on Network Softwarization, Jun 2025, Budapest, Hungary. pp.1-3. [hal-05154767](https://hal.science/hal-05154767v1)

HAL Id: hal-05154767

https://hal.science/hal-05154767v1

Submitted on 9 Jul 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Host-based Intrusion Detection for Industrial Control Systems

Omayma ALLA

Univ. Grenoble Alpes, Inria, CNRS, Grenoble INP, LIG
38000 Grenoble, France

omayma.alla@univ-grenoble-alpes.fr

Stéphane MOCANU

Univ. Grenoble Alpes, Inria, CNRS, Grenoble INP, LIG
38000 Grenoble, France

stephane.mocanu@grenoble-inp.fr

***Abstract***—Industrial Control Systems (ICS) are increasingly vulnerable to cyberattacks, particularly those that circumvent standard Network-Based Intrusion Detection Systems (NIDS) and manipulate control logic. The present investigation looks at a unique technique for improving ICS security: effectively incorporating lightweight Host-Based Intrusion Detection Systems (HIDS) into Programmable Logic Controllers (PLCs). This technique provides a more comprehensive and rapid degree of security through monitoring device activity in real time. The methodology uses formal specification methods to generate attributes from industrial control logic and regulations that can be verified at runtime. A simplified runtime monitor is built into the PLC's scanning cycle to ensure it meets real-time operating requirements. The approach is tested on the G-ICS testbed, establishing groundwork for hybrid detection methods that integrate host and network-level alerts for enhanced anomaly detection and system resilience.

***Index Terms***—Host-based Intrusion Detection System, Industrial Control Systems, Runtime Monitoring

## I. INTRODUCTION

Industrial Control Systems (ICS) serve an important role in the operation of key infrastructure in industries such as transportation, energy, manufacturing, and medicine [1]. Historically, such structures functioned in isolated locations and used proprietary technology, according to the "security through obscurity" approach. Nevertheless, with the growing convergence of operational technology (OT) and information technology (IT), ICS have grown increasingly networked [2], increasing their vulnerability to outside dangers, particularly highly sophisticated cyberattacks. High-profile attacks such as Stuxnet [3], BlackEnergy [4], and Industroyer [5] have exposed major flaws in traditional Network Intrusion Detection Systems (NIDS), which frequently fail to identify malicious activity hidden inside seemingly normal connections. These constraints highlight the necessity for complementing detection systems at the hardware level. Modern Programmable Logic Controllers (PLCs) have improved computing capability and compatibility for accessible operating systems like Windows CE. They provide platforms such as the Siemens Open Development Kit (ODK) [6], which allow the inclusion of bespoke monitoring logic. This opens the door to Host-based Intrusion Detection Systems (HIDS) that operate directly on industrial controllers, providing real-time behavioral monitoring. In this work, we investigate the feasibility of embedding a lightweight HIDS

directly onto PLCs to detect control-oriented attacks. Our goal is to synthesize and monitor formally defined security properties that respect real-time execution constraints. Ultimately, this research aims to contribute to hybrid detection strategies that combine host-level and network-level perspectives for stronger protection of industrial systems. The remainder of this paper is organized as follows: Section II reviews existing intrusion detection approaches for ICS. Section III outlines the research problem. Section IV presents the threat model. Section V describes the technical approach. Finally, Section VI presents the conclusion and future work.

## II. STATE OF THE ART

Numerous approaches to intrusion detection in industrial control systems have been explored, while the following sections provide an overview of the main strategies that have been developed.

### A. Network-Based Approaches Focused on Communication Patterns

Early ICS intrusion detection used SCADA's predictability and repetition to analyze network communication. Goldenberg and Wool [7] found robust anomaly detection with few false positives in Modbus/TCP message sequences between HMIs and PLCs using a small training set. Barbosa et al. [8] checked SCADA traffic flow for subtle message burst periodicity and dynamic anomalies. To detect significant deviations or unexpected message sequences, P. Anantharaman et al. [9] used predefined communication policies and modeled expected industrial component exchanges.

The results of these investigations illustrate the need for network-level surveillance approaches in industrial contexts, whereas current research has concentrated on host-level detection methods for comprehending system behavior. While these methods are useful for identifying network abnormalities, they are restricted when attacks originate within the framework of control logic and do not affect the flow of communication. This warrants the investigation of host-based monitoring techniques.

### B. Specification- and Model-Based Approaches

Industrial control system behavior is specified in specification-based intrusion detection, and deviations may indicate malicious activity. These methods express deterministic
models using temporal logic or execution constraints, unlike
signature- or learning-based methods. Hotellier [10] suggested
compiling security properties from industrial specifications (e.g.,
IEC/ISO standards) into reusable monitoring patterns using
LTL, MTL, or STL logic. Two industrial testbeds verified the
distributed system's scalability, which supports local (control-
loop level) and global (cross-layer) monitoring. Also, Sicard
et al. [11] developed a filter-based method to compare control
commands and sensor feedback in real time, using critical
distance and execution trajectories to quantify system behavior
deviations. It is particularly effective in identifying control-
oriented attacks that are direct, sequential, or timing-based
which are at the lower levels of ICS architecture, while also con-
sidering combinatorial and timing constraints. Sharma et al. [12]
addressed the case of embedded, resource-constrained systems
such as industrial IoT. Their BRIoT framework automatically
transforms behavior rules into execution automata, formally
verified using hierarchical colored Petri nets (HCAPN). This
approach enables lightweight yet effective anomaly detection,
capable of detecting even zero-day attacks.

These improvements demonstrate that specification-based
approaches are a potential substitute for purely mathematical
methods, particularly in safety-critical contexts where depend-
ability and formal completeness are essential. However, they
rely on comprehensive and up-to-date specifications, which
may not always be available in dynamic or legacy industrial
systems.

C. Physical Process-Aware Detection

Some intrusion detection approaches in ICSs aim to directly
monitor the physical behavior of the system, focusing on the
correlation between sensor readings, actuator commands, and
the evolution of the physical process. These methods treat
the physical dynamics as a primary source of information
to detect process-level attacks that may not be observable
through network monitoring alone. Koucham [13] proposed
a specification mining and runtime verification framework
using temporal logics (LTL and MTL) to infer valid behavioral
properties from execution traces of sequential control systems.
By automatically extracting and filtering these properties, the
method improves detection efficiency and reduces redundancy,
making it suitable for complex physical processes involving
multiple PLCs. Miao et al. [14] explored signal estimation
techniques to reconstruct actuator-level attack signals in real
time. They employed extended state observers (ESO), and they
modeled false data injection attacks as system disturbances.
They proposed both linear and nonlinear estimators (LASE and
NASE). Their approach enables the precise identification of
attack waveforms, thereby enhancing defensive responsiveness.
Pasqualetti et al. [15] contributed a theoretical framework that
analyzes attack detectability in cyber-physical systems based
on control theory and graph-based system modeling, and they
showed how some attacks could remain undetected unless the
monitoring integrates the structural properties of the physical
process.

These physical-domain methods can be used to identify
orchestrated and covert attacks. These methods are combined
with cyber-level defenses against ICS attacks for more thorough
defense and increased efficacy. These methods frequently
depend on precise physical process theories, which may not
always be accessible or simple to calibrate in real-world
scenarios.

D. *Host-Based or Embedded Monitoring*

Host-based intrusion detection approaches aim to instrument
industrial programmable logic controllers (PLCs) directly to
detect suspicious behavior at runtime [16], and by bypassing the
limitations of network-based and external monitoring systems,
these methods leverage the growing computational capabilities
of modern hardware platforms to integrate security mechanisms
as close as possible to the control cycle. Garcia et al. [16]
proposed a pioneering runtime verification solution integrated
within the PLC's program scan cycle. Their method intercepts
memory write operations, temporarily stores them in buffers,
and validates them through an embedded hypervisor based on
predefined security properties. The integration was implemented
on a Siemens industrial platform running Windows Embedded,
using the WinAC ODK environment to link the control logic
with the security module. Hilke [17] investigated runtime mon-
itoring in critical real-time systems, particularly those operated
by PLCs, while the study compares two monitoring strategies:
one manually designed from known system specifications, and
another automatically synthesized from the application code.
Both were evaluated under real-time constraints, which reveal
trade-offs between detection precision, system performance,
and resource overhead. Allison et al. [18] introduced Goosewolf,
a HIDS natively embedded in an advanced Siemens S7-1518
MFP PLC. Their solution leverages an embedded Linux OS
and virtualization to run monitoring logic in a C++ virtual
machine parallel to the control loop. By using native features
such as OPC UA and Open User Communication, Goosewolf
is capable of monitoring program integrity, tracking critical
values, and detecting malicious changes without disrupting
PLC operation.

This line of work shows promise for embedded HIDS near
physical processes. However, most solutions remain hardware-
specific and rarely support lightweight, automatic extraction
of security properties from control logic.

III. PROBLEM STATEMENT

Most existing intrusion detection research in industrial
systems focuses on network-level analysis through NIDS
solutions. However, the increasing computational power and
openness of modern Programmable Logic Controllers (PLCs)
now make it feasible to embed security mechanisms directly
into the device. This research addresses the challenge of
designing a lightweight Host-Based Intrusion Detection System
(HIDS) that can monitor control logic execution in real
time without violating PLC timing constraints. Key technical
questions include:
* What types of security properties can be automatically extracted and verified from control logic?

* How can the system remain efficient and scalable across different PLCs and industrial processes?

* How can such a host-based monitor complement NIDS as part of a hybrid detection architecture?

To explore these challenges, this work investigates the feasibility, performance, and detection capabilities of an embedded behavioral HIDS implemented on an open PLC platform, with experiments conducted on the G-ICS<fnref n="1" /> testbed [19].

## IV. THREAT MODEL

We focus on attacks that directly target the internal logic of Programmable Logic Controllers (PLCs). Attacks like these attempt to influence the system's operations, modifying control patterns, timing behaviors, or logic transitions while maintaining a regular network interface. Instances include the subtle shutdown of crucial process stages and the falsification of signals coming from input. The MITRE ATT&CK for ICS matrix identifies techniques like T0831 (Manipulation of Control) and T0835 (I/O Image Manipulation) as major risks to industrial automation and control systems. In the present study, we build our threat framework on the MITRE ATT&CK for ICS framework [20], which specifies the most significant attack strategies for our investigation. In our scenario, the suitable tactics are "Persistence", "Command and Control", "Inhibit Response Function", "Impair Process Control", and "Impact".

## V. TECHNICAL APPROACH

The goal of this study is to create a Host-Based Intrusion Detection System (HIDS) customized for commercial Programmable Logic Controllers (PLCs) that uses solely control logic expressed in programming languages specified by the IEC 61131-3 standard [21]. The aim is to continuously monitor the behavior of PLCs to identify illegal changes or discrepancies, all while adhering to the rigorous real-time limitations of industrial contexts.

This technique is a multi-step procedure. It starts with a static analysis of the PLC application to determine phases, transitions, related activities, and temporal limitations. Using this blueprint, formal safety properties are automatically created using temporal logics that involve Linear Temporal Logic (LTL) or Metric Temporal Logic (MTL) [22], [23], defining the system's intended behavior. These attributes are subsequently assembled into a lightweight real-time monitor, which is integrated as an operational component within the PLC code and is responsible for ensuring real-time adherence.

The integrated monitor [16] is active during each PLC scanning cycle. It is relatively intrusive to ensure that the system performs the necessary processes with little performance effect. Each attribute is designed as an independent function that can be dynamically activated or deactivated, allowing rapid changes in response to changes in control logic.

The surveillance strategy is based on real-time validation, which involves examining the system's behavior throughout operation. In contrast to network traffic analysis approaches, the suggested system analyzes internal events including step transitions, timing abnormalities, and control flow aberrations. When an anomaly is detected, a local alert is generated and forwarded to a supervisory layer for correlation with other alerts [24].

The observed characteristics are divided into three distinct groups: control flow accuracy (e.g., guaranteeing that phases are performed in the correct order), timing constraints (e.g., implementing delays among changes), and specific procedure security rules, including ensuring that particular actions (e.g., triggering an actuator) are performed only when the system has been confirmed safe. This categorization provides a strong layer of security for detecting abnormalities resulting from internal logic manipulation. The system will be deployed using the G-ICS testbed, which simulates serious risks such as logic manipulation, timing problems, and circumventing crucial control stages. The suggested method is intended to work in an environment integrating HIDS and NIDS, where host alarms (e.g., questionable logic execution) may be paired with network-based irregularities to identify sophisticated multi-vector attacks.

## VI. CONCLUSION AND FUTURE WORK

This research focuses on exceptional HIDS that is directly combined inside industrial PLCs founded on strong evaluation of control logic. The objective is to accurately monitor internal processes while meeting the strict real time requirements of the industrial environment. The system brings improvement in accuracy of resilience and detection to advanced cyberattacks through integrating network and host level detection technologies. Moreover, the research examines optimization tactics for decreasing effect on PLC performance. So, this research aims to deliver a scalable security architecture suitable for numerous industrial applications. Plans comprise development an initial framework for numerous industrial applications. Plans comprise development of initial model automating the development of security features and fulfilling the preliminary evaluations on G-ICS testbed and incorporating into combination detection scheme that includes network-based and host-side monitoring methods.

## REFERENCES

[1] K. Stouffer, K. Stouffer, M. Pease, C. Tang, T. Zimmerman, V. Pillitteri, S. Lightman, A. Hahn, S. Saravia, A. Sherule et al., *Guide to operational technology (ot) security*. US Department of Commerce, National Institute of Standards and Technology ..., 2023.

[2] M. Cheminod, L. Durante, and A. Valenzano, "Review of security issues in industrial networks," *IEEE Transactions on Industrial Informatics*, vol. 9, no. 1, pp. 277-293, 2013.

[3] M. Baezner and P. Robin, "Stuxnet," ETH Zurich, Tech. Rep., 2017.

[4] R. Khan, P. Maynard, K. McLaughlin, D. M. Laverty, and S. Sezer, "Threat analysis of blackenergy malware for synchrophasor based real-time control and monitoring in smart grid," in *Proceedings of the 4th International Symposium for ICS & SCADA Cyber Security Research*. BCS Learning & Development Ltd., 2016, pp. 1-10.

<footnote n="1">¹GreEn-ER Industrial Control Systems Sandbox, the main industrial systems cybersecurity lab in Grenoble, France</footnote>
[5] L. Salazar, S. R. Castro, J. Lozano, K. Koneru, E. Zambon, B. Huang, R. Baldick, M. Krotofil, A. Rojas, and A. A. Cardenas, "A tale of two instroyers: It was the season of darkness," in *2024 IEEE Symposium on Security and Privacy (SP)*, 2024, pp. 312–330.

[6] S. AG, STEP 7 (TIA Portal) Options – Open Development Kit 1500S V2.5, 2022, document ID: 109752683.

[7] N. Goldenberg and A. Wool, "Accurate modeling of modbus/tcp for intrusion detection in scada systems," *international journal of critical infrastructure protection*, vol. 6, no. 2, pp. 63–75, 2013.

[8] R. R. R. Barbosa, R. Sadre, and A. Pras, "Towards periodicity based anomaly detection in scada networks," in *Proceedings of 2012 IEEE 17th International Conference on Emerging Technologies & Factory Automation (ETFA 2012)*. IEEE, 2012, pp. 1–4.

[9] P. Anantharaman, A. Chachra, S. Sinha, M. C. Millian, B. Copos, S. Smith, and M. E. Locasto, "A communications validity detector for scada networks," in *Critical Infrastructure Protection*, 2021. [Online]. Available: https://api semanticscholar.org/CorpusID:245719980

[10] E. Hotellier, "Specification-based Intrusion Detection for Hierarchical Hybrid Industrial Control Systems," *Thesis, Université Grenoble Alpes* [2020-....], Apr. 2024. [Online]. Available: https://theses.hal.science/tel-04732741

[11] F. Sicard, E. Zamai, and J. Flaus, "Filters based approach with temporal and combinational constraints for cybersecurity of industrial control systems. ifac-pap. 51, 96–103," 2018.

[12] V. Sharma, I. You, K. Yim, R. Chen, and J.-H. Cho, "Briot: Behavior rule specification-based misbehavior detection for iot-embedded cyber-physical systems," *IEEE Access*, vol. 7, pp. 118 556–118 580, 2019.

[13] O. Koucham, "Intrusion detection for industrial control systems," *Thesis, Université Grenoble Alpes*, Nov. 2018. [Online]. Available: https://theses.hal.science/tel-02108208

[14] K. Miao, X. Shi, and W.-A. Zhang, "Attack signal estimation for intrusion detection in industrial control system," *Computers & Security*, vol. 96, p. 101926, 2020.

[15] F. Pasqualetti, F. Dörfler, and F. Bullo, "Attack detection and identification in cyber-physical systems," *IEEE Transactions on Automatic Control*, vol. 58, no. 11, pp. 2715–2729, 2013.

[16] L. Garcia, S. Zonouz, D. Wei, and L. P. De Aguiar, "Detecting plc control corruption via on-device runtime verification," in *2016 Resilience Week (RWS)*. IEEE, 2016, pp. 67–72.

[17] J. Hilke, "Runtime monitoring of plc's in critical real-time systems," Ph.D. dissertation, Massachusetts Institute of Technology, 2021.

[18] D. Allison, K. McLaughlin, and P. Smith, "Goosewolf: an embedded intrusion detection system for advanced programmable logic controllers," *Digital Threats: Research and Practice*, vol. 4, no. 4, pp. 1–19, 2023.

[19] S. Mocanu, M. Puys, and P.-H. Thevenon, "An Open-Source Hardware-In-The-Loop Virtualization System for Cybersecurity Studies of SCADA Systems," in *C&ESAR 2019, Computer & Electronics Security Applications Rendez-vous, Virtualization and Cybersecurity, November 19-20, 2019 Rennes - France* https://www.cesar-conference.org/wp-content/uploads/2019/12/CESAR_2019_Virtualisation-Cybers\%C3\%A9curit\%C3\%A9.zip, Rennes, France, Nov. 2019, pp. 1–16. [Online]. Available: https://hal.science/hal-02371133

[20] MITRE, "Mitre att&ck for industrial control systems," https://attack.mitre.org/matrices/ics/, 2021, accessed: May 2025.

[21] "Iec 61131-3:2013 programmable controllers – part 3: Programming languages," International Electrotechnical Commission, 2013, accessed: April 2025. [Online]. Available: https://webstore.iec.ch/publication/4552

[22] S. Konrad and B. H. Cheng, "Real-time specification patterns," in *Proceedings of the 27th international conference on Software engineering*, 2005, pp. 372–381.

[23] M. B. Dwyer, G. S. Avrunin, and J. C. Corbett, "Patterns in property specifications for finite-state verification," in *Proceedings of the 21st international conference on Software engineering*, 1999, pp. 411–420.

[24] P. Ning, Y. Cui, D. S. Reeves, and D. Xu, "Techniques and tools for analyzing intrusion alerts," *ACM Transactions on Information and System Security (TISSEC)*, vol. 7, no. 2, pp. 274–318, 2004.