## 2 Challenges for Reactive Protection in Industrial Automation Systems  
In order to discuss the challenges that exist for integration of reactive protection in IAS, it is important to first outline the current architectural and security trends. For this, a reference IAS architecture (Figure 1) has been derived from [15; 16]. This architecture consists of five levels (from 0 to 4) corresponding to the levels of the well-known automation pyramid hierarchy (as defined by the ISA-95 standard [17]). Level 0 (i.e., Field Level) is comprised of the sensors and actuators that constitute the physical process. The devices that monitor and control local physical processes (e.g., Programmable Logic  
Figure 1: Reference Industrial Automation System Architecture derived from [15; 16; 17]. SIEM: Security Incident and Event Management; MES: Manufacturing Execution System; SCADA: Supervisory Control and Data Acquisition; HMI: Human Machine Interface. Controllers and Remote Terminal Units) form Level 1 (i.e., Control Level). Monitoring and other management activities (i.e., alarm and alert handling) are carried out by operators at Level 2 (i.e., Supervisory Level) with support from supervisory technologies such as Supervisory Control and Data Acquisition systems (SCADA systems), Historians and Human Machine Interfaces (HMI). Level 3 (i.e., Operations Level) manages production work flows. Manufacturing and Execution Systems (MES) are popular at this level. Finally, Level 4 (i.e., Information Level) is comprised of IT systems that support the everyday operations of the organization and its business activities. Furthermore, each of these levels may also be divided into subnetworks and distributed across different geographical locations. This distribution and the wide amount of components that constitute an IAS pose challenges to their management and security. For this, multiple solutions that integrate both centralized management and security capabilities have been integrated into IAS. Two of the most popular solutions are Security Incident and Event Management (SIEM) technologies and Operational Technology (OT) Management systems. SIEM technologies are widely used in the IT field [18]. They allow for monitoring system components and manage security events and alerts through the aggregation, analysis and reporting of security information. Some of these SIEM technologies have included capabilities that facilitate Industrial Control System operation and management, which have made them suitable for IAS [15]. OT Management systems provide similar capabilities to that of SIEM technologies, however, they are more focused to IAS-specific operations such as control network monitoring and risk management (e.g., Industrial Defender Automation Systems Manager (ASM) [19]). Both SIEM technologies and OT Management systems centralize their analysis and visualization components. SIEM technologies are often deployed at level 4 (i.e., Information Level), whereas OT Management systems are often deployed at levels 2 and 3 (i.e., Supervisory Level and Operations Level). In order for these technologies to provide protection to lower levels of the automation hierarchy, it is necessary that they provide capabilities that allow them to monitor network and components located at these lower levels or that they are capable of receiving information from other security solutions located at these network levels. Some of the security solutions capable of providing this information are databases, Antivuses, Intrusion Detection Systems (IDS) (both for enterprise and industrial networks) and Intrusion Prevention Systems (IPS) [15].