## 7 Defenses
Even though the ACL can restrict access sources by a safelist, it is not suitable for a dynamic ICS environment, and the safelist also needs to be updated frequently. Commercial products such as industrial gateway and access manager would be a better choice to overcome these shortcomings. Industrial Gateway and Access Manager. An industrial gateway is used to interface between networks that support different protocols, which makes communication possible between the many resident architectures and protocols in both the IT and OT domains. On the other hand, the industrial gateway is another defense method of border security. An industrial gateway contains functionality such as an access manager, field device collection, parameter data monitoring, protocol converters, impedance matching devices, fault isolators, or signal translators necessary to provide system interoperability and access security. ICS-ARC-like attacks presuppose access to the ICS network, which industrial gateways can also prevent. Moreover, the industrial gateway can also monitor the parameter  
Figure 15: Different Defense Stages of ICS-ARC. data of PLC instructions, such as uploading and downloading the PLC control logic. Once sensitive parameters are detected at the traffic level, attacks can be blocked immediately. There are many commercial gateways, such as ABB and B&B, which can provide more comprehensive access security protection and a more friendly interface. Moreover, there are also some academic types of industrial gateway architectures, such as SDN-based industrial security gateway [45], software-defined industrial gateway [46], and hardware-based industrial gateway [47]. Industrial Firewall. The industrial firewall is designed to monitor incoming and outgoing network traffic and decide whether to allow or block specific traffic based on a set of security rules. A firewall can either be software or hardware classified into different categories, such as packet filter firewalls, stateful firewalls, application proxy firewalls, and deep packet inspection firewalls [48]. Commercial firewalls such as CISCO ASA operate on specialized hardware that has attempted to use their firewall in SCADA networks by developing a Netfilter module that uses Modbus protocol header fields together with Iptables [49]. Compared with industrial gateways, industrial firewalls are more professional in monitoring traffic. For example, in this work, we select the Siemens PLC as the target, communicating with the S7 Comm protocol. In the S7 Comm protocol, the upload and download functions are realized through 0x1A-0x1F function codes, as shown in Table 7, which can be set as crucial monitoring parameters. Although the industrial firewall can effectively prevent malicious attacks, it requires a comprehensive and in-depth understanding of industrial control protocols. However, most industrial control protocols are private, so avoiding false negatives and positives is always tricky. Machine Learning Technologies. Intrusion detection is a crucial component of ICSs to detect malicious network packets. Machine learning could distinguish regular packets from abnormal packets, and this distinction could serve as an intrusion detection system. Automating this form of intrusion detection can help monitor significant network traffic based on intrusive signatures or intrusive patterns [50]. At the same time, machine learning techniques can also be combined with other defense methods to achieve better detection results. On the PLC security side, some defense methods exist, such as control logic obfuscation and PLC architectural developments. Compared with other defense measures, this type of defense method is mainly based on PLC, which needs to improve the PLC structure or occupy the operating resources of PLC. Control Logic Obfuscation. Much of the existing research on PLC control logic program obfuscation has been attempted in many fields, such as evading malware signature matching [51] and preventing code injection into address spaces [52].