## 4 Related Work
### Reactive Actions in Individual IAS Components or Configurations  
Active responses that affect individual IAS components or configurations are commonly used to counteract the effects of an intrusion. This means that at this stage the intrusion has already succeeded and its consequences affect the IAS. A wide range of approaches exist to execute these actions. This occurs due to the specificity of each of the individual IAS components and the configurations.  
In [39], a dynamic response system for protection of SCADA systems is presented. This response system monitors and analyzes data related to the performance of both the physical process and the SCADA system in order to detect intrusions. This analysis implements signature-based and anomaly-based intrusion detection using forecasting models (i.e., AutoRegressive Integrated Moving Average) and classifiers (i.e., Naive Bayesian). Once an intrusion has been detected, the response system evaluates four criteria in order to select an active response with low impact to the IAS and its operational requirements. The evaluated criteria are: enhancement of security (C1), operational costs (C2), maintenance of normal operations (C3), impacts on properties, finance and human lives (C4). From this criteria, C4 is the one that defines whether or not human intervention is necessary to execute an active response. Although five active responses are supported by the response system (i.e., dropping malicious commands, termination of physical processes, replacement of compromised devices, one time authentication and isolation of compromised devices), only two of them can be executed without human intervention: dropping of malicious commands and one time authentication.  
Another approach for protection of smart grid nodes is presented in [40]. This approach is based on game models and evaluates the impact of the behaviour of both the attacker and defender in order to select appropriate active responses to counteract the effects on an intrusion. These responses are executed by human users and are comprised of the following: cut off the energy of a sensor or maintain correct data and valid nodes by discarding data from malicious nodes and updating routing tables to exclude bad sensor nodes.  
In [41], a protection approach for CPS is presented. This approach is based on a multi-layer architecture that considers special requirements for CPS. The layers of this architecture are the following: IT security, active protection, intrusion tolerance and physical security. Detection of intrusions and their corresponding active responses are supported by the intrusion tolerance layer. In this layer, intrusion detection is performed through model-based anomaly detection and supported by an impact assessment. The selection of the appropriate active responses is determined through a security strategy that integrates a game process. These responses are comprised of dynamic reconfiguration of system components.  
Additional work regarding reactive responses in the presence of intrusions has been made within the context of the CockpitCI project [42]. This project focuses on the improvement of resiliency and dependability of Critical Infrastructures (CIs) through the identification of- and immediate response in the presence of security events (e.g., intrusions). This is performed by evaluating the possible consequences and impact (i.e., by evaluating the risk) of such security events and, in case it is necessary, alerting the operators in order to implement timely containment strategies (i.e., passive and active responses). Some of these strategies may execute automatic reactions. However, to the best of our knowledge, these reactions are mostly focused on ensuring the resiliency of the automation system in the presence of faults, rather than targeted attacks. An example of a preventive action mentioned in the literature is the restart of a component.