FPGAbased Realtime Abnormal Packet Detector for Critical Industrial Network As the information technology plays an important role in the smart factories, Ethernetbased industrial network has rapidly replaced the traditional field buses. To maintain this critical network secure, it is important to develop the realtime network intrusion detection system (NIDS). The widely used NIDS was developed for the general Internet environment where the average throughput to protect attacks from the large number of unknown network nodes is more important than the realtime detection capability. However, in the critical industrial network, the realtime protection is more important than the average throughput. In this paper, a FPGAbased abnormal Ethernet packet detector is proposed. Since it is designed for the closed industry network, packet detection is based on the whitelist that consists of the allowed network address and protocol numbers. The prototype system has been implemented using the Xilinx Zynq7030 SoC running at 250MHz. The network header of the Ethernet packet is compared to the 256 whitelist ruleset within 0.032xcexbcsec, which means that the malicious packets from the abnormal network nodes are filtered out even before the whole packets arrives. This realtime packet filtering feature is useful in protecting highly secure network systems like the critical industrial control systems.

Evaluation Framework for Network Intrusion Detection Systems for InVehicle CAN Modern vehicles are complex safety critical cyber physical systems, that are connected to the outside world, with all security implications it brings. Different network intrusion detection systems (NIDSs) proposed for the CAN bus, the predominant type of invehicle network, to improve security are hard to compare due to disparate evaluation methods adopted. In this paper we provide the means to compare CAN NIDSs on equal footing and evaluate the ones detailed in the literature. Based on this we observe some limitation of existing approaches and why in the CAN setting it is intrinsically difficult to distinguish benign from malicious payload. We argue that xe2x80x9cmeaningawarexe2x80x9d detection (a concept we define) which is challenging (but perhaps not impossible) to create for this setting.