Process-aware security monitoring in industrial control systems: A systematic review and future directions

Muaan ur Rehman, Hayretdin Bahşi

Research output: Contribution to journalReview articlepeer-review

Abstract

Due to the tight coupling between the cyber and physical components, control systems are subjected to emerging cyberattacks. In addition to attacks based on networking and communication, control systems are also susceptible to process-aware attacks that target the business logic behind a physical process. Due to the increasing frequency of such attacks, the process-aware defence mechanisms that incorporate knowledge of the underlying physical model, has gained increased attention in current cyber–physical system security-related research. However, the rapid expansion of literature complicates the ability to thoroughly review and ascertain the state-of-the-art, as well as to identify existing research challenges and gaps. This paper investigates research on process-aware-based security monitoring for control systems and aims to establish a common understanding of currently used methods in this domain. A systematic literature review is performed to outline and classify the existing work and present the authors’ cybersecurity vision. From an extensive review of publications between February 1, 2009 and October 30, 2023, we analysed and categorized the existing research on process-aware security monitoring techniques for control systems. Furthermore, we identified process-aware attack categories posing threats to the physical process in critical infrastructures. We have further mapped these attacks to the MITRE ATT&CK matrix for Industrial Control Systems (ICS), detailing their tactics, techniques, and impacts.

Original languageEnglish (US)
Article number100719
JournalInternational Journal of Critical Infrastructure Protection
Volume47
DOIs
StatePublished - Dec 2024
Externally publishedYes

Keywords

  • Behaviour-based intrusion detection systems
  • Critical infrastructures
  • Cyber security
  • Cyber-physical systems
  • Industrial control systems
  • Process-aware attacks

ASJC Scopus subject areas

  • Modeling and Simulation
  • Safety, Risk, Reliability and Quality
  • Computer Science Applications
  • Information Systems and Management

Fingerprint

Dive into the research topics of 'Process-aware security monitoring in industrial control systems: A systematic review and future directions'. Together they form a unique fingerprint.

Cite this