# Advancements and Research Trends in Microgrids Cybersecurity
## 5 Intrusion Detection Systems  
Intrusion Detection Systems (IDS) are devices or software applications that monitor a portion of the systems and try detecting malicious activities and policy violations. IDS can be classified from different viewpoints. We can identify two big families:  
* Network Intrusion Detection Systems (NIDS) that analyze network traffic collected from one or more points of the communication network; and
* Host Intrusion Detection Systems (HIDS) that analyze the activity of a single host (i.e., a terminal) of the network. Other classifications can be based on the strategy used to detect the malicious activity (signature-based or anomaly-based) or on the action that the system implements after detecting an attack (IDS can be purely passive or block traffic flows/applications, usually referred to as Intrusion Prevention System (IPS)), as shown in Table 2.  
Different NIDS solutions specifically designed for ICS protocols have been proposed in the literature and are also available as commercial solutions. NIDS are usually passive elements of the network to avoid them significantly slowing down the responses to attacks. It would be dangerous to implement an active element in a safety-critical control network due to the possible high false positive rate that would affect the whole system safety. In the IT field, two common HIDS solutions are Open Source HIDS SECurity (OSSEC) and Tripwire. OSSEC is a free and open-source HIDS that supports a wide range of Operating Systems (OS), while Tripwire is a commercial solution. These solutions combine passive actions performed periodically in order to not affect the system performance, such as the identification of unauthorized file modifications (through, for example, file integrity checking by using checksum databases), of malicious processes, and of log behaviors (for instance by monitoring specific parameters), and active capabilities, similarly to host firewalls that allow blocking unauthorized network communications by adding firewall rules. A further improvement in the field of HIDS is online intrusion detection (or \"real-time\" or \"in-line\" intrusion detection). Real-time HIDS analyze different features of the host, including OS aggregated behavior, such as CPU and memory metrics, shell commands, and system calls; application information, such as loaded modules and libraries, programming code, and processes; user behavior and host network information, such as physical and logical interfaces, and their configuration, as well as network packets [34]. Nevertheless, in order to implement HIDS in ICS devices, further considerations are necessary. Two major challenges have to be faced: the time performance in devices with severe latency requirements and low computational power, and the risk related to the implementation of active HIDS. Attributes that a HIDS suitable for ICS application should include are [35]:  
* Configurability: capability to be configured as specified by the requirements of the target system;
* Configuration and Knowledge Security: HIDS configuration and used data should be protected against unauthorized access and modifications;
* Resiliency: HIDS action cannot affect the availability of the device;
* Low Performance Overhead: the execution of the HIDS on the target device should not negatively influence the performance of the underlying system; \begin{table}
\begin{tabular}{l c c} \hline \hline
**IDS Classification** & \\ \hline By monitored element & Network-IDS & Host-IDS \\ By actions & Passive (IDS) & Active (IDS and IPS) \\ By detection methods & Signature-based & Anomaly-based \\ \hline \hline \end{tabular}
\end{table} 
Table 2: IDS classification. * Low Detection Time: detection and response to intrusions should be as fast as possible; and
* Interoperability: the HIDS should be able to interact with other technologies, such as Security Information and Event Management (SIEM).