Abstract-We address the detection of process-related threats in control systems used in critical infrastructures. Processrelated threats take place when an attacker gains user access rights and performs actions, which look legitimate, but which are intended to disrupt the industrial process. We use logs to detect anomalous patterns of user actions on process control application. A preliminary case study suggests that our approach is effective in detecting anomalous events that might alter the regular process workflow.
REF used the logs generated by the control application running on the HMI to detect anomalous patterns of user actions on process control application.
MELISSA: Towards Automated Detection of Undesirable User Actions in Critical Infrastructures
2011 Seventh European Conference on Computer Network Defense
2011 Seventh European Conference on Computer Network Defense
Physics Computer Science Chemistry