## 1 Introduction
[12], especially future robotic surgical devices will have to compete on their supported connectivity interfaces for information exchange and integrate the information of other devices. This is also applicable for other CPSs. In the early days of IT security, approaches such as _Demilitarized Zones_ that segregate internal network hosts from the ones that need to communicate to the Internet via one or multiple firewalls were popular [13]. In this case, the network traffic from external hosts is untrusted, whereas internal traffic is trusted. Thus, IT security evolved toward a zero trust approach, where the entire traffic has to be authenticated [13]. Especially, IDS with an anomaly-based approach are viable, since they are able to detect previously unknown (_zero-day_) attacks [14]. IDS from IT, e.g., the well-known open-source solution _Snort_, lack a detailed analysis of CPS-specific protocols and applications. When it comes to analyzing the communication of an SOA, the capabilities of previous approaches are limited [15] (see also Section 2.4). Thus, our work focuses on the development of an IDS for the monitoring of CPSs that employ an SOA. To give the reader a more intuitive understanding of the generic approach outlined in the following, we apply our idea to two representative CPSs: an automotive SOA and a medical device SOA. _Problem:_ As service-oriented communication is no longer fully specified during design time and participants can enter and leave networks dynamically, it is increasingly difficult to determine rules to maintain the system security. Moreover, the flexibility that the paradigm is supposed to provide is accompanied by a loss of security, since the static communication relationships of traditional signal-based networks are absent. Moreover, according to the review of Network Intrusion Detection System (NIDS) by [PERSON] et al., research in CPSs is still in its early stages, although interest has increased massively in recent years [16]. Most of today's IDSs focus on traditional IT computer networks and therefore do not consider the dimension of the physical environment of networked CPSs. In addition, despite the similar trend in several CPS domains to use SOA approaches, the underlying middlewares and protocol standards (see Section 2) are different and incompatible with each other. When using traditional IDSs, which often work directly on the protocol standard, they are strictly dependent on the underlying technology. Therefore, synergies between the different domains are hard to achieve. ContributionWe propose a first step toward a generic IDS based on the communication standards Data Distribution Service (DDS), Scalable service-Oriented MiddlewarE over IP (SOME/IP) and Service-oriented Devices Connectivity (SDC) that can be adapted to other service-oriented middlewares such as Open Platform Communications Unified Architecture (OPCUA), which is widely used in automation engineering [17]. Furthermore, we chose a distributed approach using an NIDS that also collects data from Host Intrusion Detection System (HIDS) sensors of the different participants. Therefore, we identify different anomaly patterns which could occur in such a set of networked devices and apply them to a medical and an automotive use case. As shown in Section 2.4, current IDSs lack the necessary features for CPSs-specific protocols and applications. The capabilities of the already reported approaches are too limited to analyze the communication of an SOA for IDSs, especially for CPSs  
OutlineFirst, we introduce the SOA paradigm in Section 2.1 and explain the background for service-oriented communication in the automotive as well as the medical field in Sections 2.2 and 2.3. We then examine the communication patterns common to the standards in question and present related work for both domains in Sections 2.5 and 2.6.