# Network Security in the Industrial Control System: A Survey

Yang Li, Shihao Wu, Quan Pan All of the authors are with the School of
Automation, Northwestern Polytechnical University.Please note that all of the
works we summarized are before 2020.

###### Abstract

Along with the development of intelligent manufacturing, especially with the
high connectivity of the industrial control system (ICS), the network security
of ICS becomes more important. And in recent years, there has been much
research on the security of the ICS network. However, in practical usage,
there are many types of protocols, which means a high vulnerability in
protocols. Therefore, in this paper, we give a complete review of the
protocols that are usually used in ICS. Then, we give a comprehensive review
on network security in terms of Defence in Depth (DiD), including data
encryption, access control policy, intrusion detection system, software-
defined network, etc. Through these works, we try to provide a new perspective
on the exciting new developments in this field.

###### Index Terms:

Industrial Control System, Security, Network Security.

##  I Introduction

The new generation of information technology, especially the new generation of
intelligent manufacturing, is developing rapidly and accelerating its
integration with the internet, which brings new opportunities for the
transformation and upgrading of the global manufacturing industry. However,
the high connectivity of industrial control systems (ICS) makes their security
an important issue. In particular, the diversity of industrial control network
protocols increases the vulnerability. More than 70% of the vulnerabilities
disclosed in ICS in the first half of 2020 were remotely exploited by cyber
attack carriers, according to an industrial cybersecurity firm
111https://www.securityweek.com/over-70-ics-vulnerabilities-disclosed-first-
half-2020-remotely-exploitable.

In the view of cybersecurity, network security is confidentiality and non-
repudiation of the communication in ICS, which includes protocol security,
network structure security, etc. To ensure network security for ICS network
designs, different organizations come up with different standards. For
example, the National Institute of Standards and Technology (NIST) proposed
the guidelines for ICS Security [1] since 2011, the International
Electrotechnical Commission (IEC) proposed the ISA/IEC 62443-4-1 [2] in 2018
to ensure lifecycle security in ICS, etc. Different from traditional networks,
industrial devices can be divided into different sectors or zones according to
their functions and positions in ICS. Therefore, defense-in-depth (DiD) is an
important way to ensure network security for the entire industrial network
system. A DiD, usually includes data encryption, access control policies,
intrusion detection system, etc. Data encryption is to ensure the
confidentiality of data transmission, usage, and storage. The access control
policy is a direct way to protect the ICS from hostile detection. And the
intrusion detection system is a mostly used way to monitor malicious activity
or policy violations in the ICS. Therefore, in this survey, we will elaborate
on how these strategies work and how they typically behave in an ICS system.

Plenty of research has been done on ICS network security. However, as far as
we know, there are very few systematic reviews that well shape this area and
current progress. Although some works have given the spotlight on the survey
of ICS security, e.g., Knowles et al. [3] surveyed the methodologies and
research that all before 2015 in the view of ICS security measuring and risk
management. Xu et al. [4] reviewed the works in view of the protocols that are
used in ICS. Recently, You et al. [5] provided a brief introduction to ICS
security given security control tendency, ICS operation, network layer, etc.
Although these works have explored ICS security from different views, there is
still lacking a systematic survey on the current progress of network security
in ICS. Furthermore, different from previous studies, our focus is more on the
defense in depth which is more practical.

The structure of this paper is described as follows: In section II, we provide
a discussion about the ICS network. In section III, we give a discussion about
the defense in depth which expounds on data encryption, access control policy,
intrusion detection, software-defined network, etc. Finally comes the future
research directions in section IV

##  II ICS Networks

With the development of connectivity and openness, communication security has
become a major threat to ICS. In view of different scenarios, the protocols,
network structure, etc., may be different in an ICS. Meanwhile, one of the
features of ICS is the diversity of protocols and there is no unified standard
for its design. Therefore, it will be a challenging task to guarantee network
security in ICS. In this section, we will describe the protocols, and network
structure in ICS.

###  II-A Network Structure

An ICS network is organized by: Programmable Logic Controller (PLC) which is
an industrial digital computer used in controlling manufacturing processes,
Remote Terminal Unit (RTU) which is a microprocessor-controlled electronic
device that interfaces objects in the physical world to the SCADA system,
Intelligent Electronic Device (IED) which is an integrated microprocessor-
based controller that usually used in power system, and Human Machine
Interface (HMI) which is a control panel that operates PLCs, RTUs.

Based on the different requirements of ICS application scenarios, different
network topologies are needed. For example, the devices are usually divided
into groups, or zone based on their location, usage, function, or network
security [6], which is also recommended by NIST [1], details will be
introduced in Section III-B2. As recommended in the standard ISA-62443
222https://www.isa.org/training-and-certification/isa-
certification/isa99iec-62443/isa99iec-62443-cybersecurity-certificate-
programs, the topology can be designed as the enterprise zone and plant zones
in terms of the network security and functions which is illustrated in Figure
1.

Figure 1: An example of the zone in an ICS network (ISA-62443 zone), cited
from [6].

To ensure security, there is no connection among zones. Another commonly used
topology, shown in Figure 2, is a three-level ICS network: management level,
supervision control level, and device control level. The management level can
be seen as a traditional IT structure whose security is guaranteed by
traditional defense methods. And in the supervision control level and device
control level, different kinds of protocols are applied, e.g., ModBus
333https://modbus.org/, ProfiNet
444https://www.profibus.com/technology/profinet/, DNP3
555https://www.dnp.org/About/Overview-of-DNP3-Protocol, etc. However, seldom
security modules are applied in those two levels in practice due to the
incompatibility of manufacturing devices and protocol diversity.

Figure 2: Another example of the ICS topology.

Previously, cable distance, traffic distribution, traffic balance, network
delays, etc., are the main considerations in the ICS network designing [7],
especially in the real-time system. However, with the interconnectivity of
ICS, network security has become a serious issue. Also, the researchers start
to focus on safe neural network designing in ICS. But it is hard to reconcile
the traditional requirement and the security. The general problems that an ICS
network needs to concern with include real-time data transfer, geographical
position limitation, strong determinism, etc., which are difficult to
harmonize, and the security requirement makes it even harder [8].

###  II-B Protocols

The protocol is the basic element for communication in ICS, and plenty of
works focused on the security of a specific protocol. And the truth is that
massive protocols exist in ICS and most of them are non-public. More sadly,
most of the protocols do not consider the security mechanism when they are
designed and applied. In this subsection, the commonly used protocols in ICS
will be analyzed in authorization, encryption, availability, integrity, and
confidentiality those aspects respectively[4]. The details are listed in Table
I.

| Authentication | Authorization | Encryption | Availability | Integrity | Confidentiality
---|---|---|---|---|---|---
Profinet [9, 10] |  | $\surd$ | $\surd$ | $\surd$ | $\surd$ |
DNP3 [11, 12, 13] |  |  |  | $\surd$ |  | $\surd$
Modbus [14, 15] |  | $\surd$ | $\surd$ |  |  | $\surd$
IEC 60870-5104 [16, 17] |  | $\surd$ | $\surd$ |  |  | $\surd$
IEC 61850 [18, 19] |  |  |  | $\surd$ | $\surd$ | $\surd$
IEC 61400-25 [20, 21] | $\surd$ | $\surd$ | $\surd$ | $\surd$ |  | $\surd$
IEEE C37.118 [22] | $\surd$ | $\surd$ | $\surd$ |  |  |
TABLE I: The detail of the weakness in common used ICS protocols (Partly cited
from [4]).

In the table, Authentication indicates the mechanisms that judge an identity,
if there is no authorization in a protocol, the privileges can be easily
gained with the forge protocol packets. Authorization is a security mechanism
to determine access levels based on the user’s identity. If there is a lack of
authorization, malicious users can send any information or resource to others
without permission. Encryption denotes whether there is cryptography in the
protocol, if there is no encryption, the communication data can be captured
easily by malicious attackers. Availability is the status of the ICS device or
service, if it is a lack of availability, ICS may lose control which may cause
an industrial accident. Integrity indicates whether the data is transmitted
completely, if there is a lack of integrity, communication data can be
rendered useless by package missing or corruption. Confidentiality refers to
ICS’s protection against unauthorized access and misuse. Without
confidentiality, unauthorized users can exploit vulnerabilities to achieve
illegal purposes.

Real-time Ethernet (RTE) is a set of protocols that support real-time
operation, and all of those protocols are designed based on the IEC 61784-1.
All protocols mentioned below belong to RTE.

####  II-B1 Profinet

Profinet is usually used in data communication between controllers (e.g.,
PLCs, DCSs, or PACs, etc.) and devices (e.g., I/O blocks, RFID readers,
proxies, etc.). There are four layers in Profinet which are Ethernet (physical
and data link layers), IP (network layer), TCP&UDP (transport layer), and
other protocols (application layer). In some specific Profinet versions, to
make Profinet faster, it may skip the IP, and TCP&UDP layers, e.g., Real-Time
Profinet. Profinet has two versions which are Profinet CBA and Profinet IO,
Profinet CBA is suitable for component-based communication via TCP/IP, while
Profinet IO is used in systems requiring real-time communication. As there is
no authentication mechanism in the original version. Therefore, it suffers
from the network security problems, such as man-in-the-middle, including
packet flooding, packet sniffing, etc. To tackle this problem, Oh et al. [23]
added an Integrity Check Value (ICV) module at the base of Profinet/DCP (with
DCP as configuring protocols) to the authentication data field. Guilherme et
al. [24] proposed an anomaly detection method that can identify four different
events that happened in Profinet. In summarizing, there is a high
authorization, encryption, integrity, availability w.r.t., network security
[9, 10].

####  II-B2 DNP3

DNP3 is designed based on the IEC TC-57 standard, and it is a three layers
protocol. Even with the large scale of the application, DNP3 is still weak in
security guaranteed. Firstly, there is no authentication protection in DNP3,
and it is easy for an attacker to disrupt the control process by creating a
normal conversation. Secondly, it is also lacking authorization protection,
and any user can run any functions over it. Finally, there is no encryption
protection, and the messages it transmits are in plain text. To ensure the
DNP3’s security, Jeong-Han et al. [25] detected the intrusion by producing a
burst-based whitelist model. Bai et al. [26] proposed an automation protection
framework to detect the attacks that aim at the DNP3. Hao et al. [27] designed
a set of snort rules on the DNP3 networks for intrusion detection. Sahebrao et
al. [28] enhanced the DNP3’s security by modifying the internal protocol
structure and encrypting its packages with Blowfish [29], and Ye et al.[30]
proposed an improved version of DNP3-BAE by using the hashing chain.

####  II-B3 Modbus

Modbus is one of the most popular and oldest protocols in the ICS
communication module, it was designed to connect with PLCs in 1979, and now it
is broadly applied in industries with two kinds of implementation. One is
serial Modbus, which applies the high-level data link control (HDLC)
standard666http://en.Wikipedia.org/wiki/High-Level_Data_Link_Control. And the
other one is the Modbus-TCP, which adopts the TCP/IP protocol stack [31]. Same
to DNP3, lots of works are proposed to enhance this protocol. Emil et al. [32]
proposed an authentication method for the device when connecting with Modbus
TCP. Fei et al. [33] designed a new format of Modbus named SecModbus, it did
not increase the communication procedure and ensured confidentiality,
integrity, and authorization at the same time. Apart from the improvement over
the Modbus protocol, Yusheng et al. [34] designed the stereo depth intrusion
detection system (SD-IDS) to inspect the Modbus TCP traffic.

####  II-B4 IEC 60870-5104

IEC 60870-5104 (also known as IEC 870-5-104) is an international standard,
released in 2000 by the IEC (International Electrotechnical Commission).
Several protocols are designed based on this standard, e.g., ip4Cloud/SEC3PB
which is to capture Profibus data by eavesdropping and transmitting it to
SCADA services, and ip4Cloud/SEC3IO which is to switch and monitors digital IO
status to transmit them to SCADA services. The protocol under this standard
can be used for remote control tasks between the control center and the
substation. Generally, there is no authentication and encryption mechanism in
IEC 60870-5104, and all the messages are transmitted with plain text. Due to
such problems, protocols under this standard are vulnerable: Maynard et al.
[17] analyzed the attack behaviors to the IEC 60870-5104 protocols and
deployed the man-in-the-middle attack over the SCADA system successfully and
suggested that rule-based methods can be applied in the security insurance.
Recently, Qassim et al. [35] showed that a successful control command
injection attack can be implemented by exploiting the previously identified
vulnerabilities in their designed SCADA testbed. To ensure security, with the
help of the open-source Snort tool777https://www.snort.org/, Yang et al. [16]
used a rule-based method to detect the intrusion that deployed on this
protocol. To protect the substation automation network based on IEC 60780-5104
protocol, Hodo et al. [36] proposed a machine learning-based framework to do
intrusion detection.

####  II-B5 IEC 61850

IEC 61850 is a standard developed by IEC Technical Committee no. 57 Working
Group 10 and IEEE for Ethernet (IEEE 802.3) based communications in
substations. It is an international standard defining communication protocols
for intelligent electronic devices at electrical substations. As with many
other communication standards, IEC 61850 was developed without extensive
consideration of critical security measures. It always suffers from plenty of
attacks including eavesdropping, data spoofing, DOS, password cracking, etc
[37]. To tackle the security problems in IEC 61850, IEC 62351 (Part 3, 4, and
6) is developed by the same committee in 2007. For details please refer to
Youssef et al.’s work [18].

####  II-B6 IEC 61400-25

IEC61400-25 is a standard developed by the IEC TC88 Technical Committee. It is
specifically aimed at the monitoring system communication of wind power
plants. This standard aims to realize free communication between equipment of
different suppliers in wind power plants [38]. The security of network
communication between wind power plants is required in IEC 61400-25-3. But the
method of implementation is not specified, and it is left to the protocol
itself [39]. With the development of the Internet, wind power plant
communication based on Web services has become a common way. However, there
are significant potential security risks, and while access can be restricted
by user name/password, they do not provide additional protection for
confidentiality and integrity. To ensure the security of Web-based service,
Liu et al. [21] extended the simple object access protocol message, and
designed the security agent with a security message processing algorithm to
achieve confidentiality integrity and authentication across the communication.

####  II-B7 IEEE C37.118

IEEE C37.118 defines the data transmission format and synchronization
requirements between the communication of substations. This protocol defines
four different types of messages, including data, header, configuration, and
command. Like most other protocols, it lacks predefined security mechanisms,
which makes it vulnerable to network attacks. Attacks like reconnaissance,
man-in-the-middle, DOS, etc., severely impact the synchrophasor application,
sometimes, it may even cause physical damage to the equipment [40]. To ensure
the security of this protocol, Stewart et al. [41] validated the security by
using the firewall and Virtual Private Network between the substation and
control center. Basumallik et al. [42] recommended encryption algorithms
(e.g., AES), IPSEC, and DTLS to ensure the confidentiality and authentication
of the data without affecting the instantaneity.

##  III Defense in Depth

It is a widely-known concept in IT security with defense in depth (DiD). To
make a redundant security defense system in ICS, DiD also is necessary along
with the development of ICS’s connectivity. It is better to apply DiD in all
ranges of ICS that include proactive protection, such as data encryption and
access control, etc., as well as reactive protections, such as intrusion
detection, intrusion protection, and network range, etc. In this section, all
of these topics will be introduced here.

###  III-A Data Encryption

Encryption which is to transform the plaintext data to cipher data using the
cryptographic function is an important way to ensure the confidentiality and
integrity of the data. As we know, encryption is the fundamental way to
guarantee the security of the data. Encryption has been a necessary method to
ensure the security of ICS. The cryptographic methods can be divided into
those three categories, the first one is symmetrical cryptography which uses
the same key for the transformation, the second one is asymmetrical
cryptography (also named public-key encryption) which using the public and
private keys separately when doing the encryption and decryption, the public
key can be open, while the private key needs to be kept secret. And the third
one is hash-based cryptography which mainly is applied in integrity
verification. The technique structure of the cryptographic methods shows in
Figure 3

Figure 3: The structure of the cryptography.

In cryptography, there are two different kinds of cipher methods, one is a
block cipher which encrypts a block of text at a time, rather than encrypting
a bit that doing in the stream cipher. Block cipher is safer than the stream
cipher, but it cost more time during the encryption. Methods like DES [43],
3DES [44], AES [45], SM1 and SM4, etc., are all the block cipher, which
usually are deployed in the communication system in ICS. However, a stream
cipher is fast but it is easy to be cracked. The most popular stream cipher is
RC4 which was used in Transport Layer Security (TLS) before 2015 [46]. As to
asymmetrical cryptography, The RSA and SM2 belong to asymmetrical
cryptography, and SHA-series, SM3, and MD5 are hash-based cryptography. Based
on the applications, different cryptographies can be deployed.

In ICS, before deploying the cryptographic algorithms, such things should be
taken into consideration: high safety, low cost, and high performance [47].
However, due to the special need in the ICS, there are different voices in
encryption applications in ICS. Fauri et al. [48] made a critical discussion
about the encryption application in ICS, and concluded that the encryption
process will not help increase the overall safety of the ICS, sometimes the
encryption process even has negative consequences for the security. Therefore,
different cryptographic algorithms or standards are applied along with
different applications. For example, In the power systems infrastructure, IEC
62351 recommends end-to-end protocol TLS and point-to-point protocol IPsec,
however, it is end-to-end protocol WSSeurity in the industrial automation
system.

###  III-B Access Control Policy

It is a proactive protection method for ICS security, which includes a
firewall, network address translation (NAT), etc. It is a direct way to make
the access control policy to protect the ICS from hostile detection.

####  III-B1 Firewall

A common method is adopting the white list in the firewall to prevent unknown
access [49]. Byoung-Koo et al. [50] designed the Industrial Cyber Attack
Prevention-Gate system for the ICS, and aimed to prevent unauthorized access
fundamentally by applying the firewall in all of the levels mentioned before,
the drawback was decreasing the latency of the ICS in return. To reduce the
latency of the firewall matching in the white list, the hash-based rule lookup
was proposed by Pabilona et al. [51]

There are two ways to white list building, one is the static list, and the
other one is the generated-dynamic list. The static list is time costing,
inflexible, and limited in expression, but it is precise in prevention. And it
is the opposing situation in the generated-dynamic list. There are lots of
works in exploring static list building. The distributed firewall was proposed
by Peng et al. [52], and each device was configured with different policies by
using the static white list. Woo-Suk et al. [53] applied the PrefixSpan
algorithm to generate the structured static white list, which improves the
flexibility of the static list. Besides the static white list, plenty of works
are proposed for dynamic list generation. Barbosa et al. [54] learned the
white list via the flow by using the dynamic port allocation. Choi et al. [55]
generated the white list automatically based on the flow’s locality. There
also are some works learning the white list with dynamic packet inspection.
Jeyasingam et al. [56] extended the Linux-based firewall for the DNP3 protocol
in the power grid, and the u32 feature-match mechanism lets the firewall
extract any parts of the package, which made the white list more dynamic.

####  III-B2 Security Zone

Based on the standard proposed by NIST [1], the ICS network usually partitions
into several different zones (such as trust zone, demilitarized zone, etc.),
especially for some sensitive companies which have high requirements for
security. However, lots of problems need to deal with. Bela et al. [8] treated
the network designing in ICS as the integer linear programming (ILP) problem,
and the security are added as the constraints to fulfill security requirement,
finally, the results are assessed by the cyberattack impact assessment (CAIA).
Jun et al. [57] proposed an automated zone partition method based on the
physical system causal model to do anomaly detection. This method adopts the
zones crucial states as the input, which means more data should be packaged
back into the system to make the zone partition decision.

###  III-C Intrusion Detection System

####  III-C1 Vulnerability Detection

Vulnerabilities are a common problem in traditional systems, as well as in
ICS. The number of vulnerabilities in ICS has increased dramatically since
they were first published in 1997 [58], especially in the recent seven years
which can be seen in Figure 4(a). Before 2015, the number is cited from [58],
and after 2015, the numbers are counted from the website of CNVD
888http://ics.cnvd.org.cn/)999http://ics.cnvd.org.cn/, the number of
vulnerabilities in 2018 is counted before 10th September.

(a) The vulnerabilities number discovered in ICS since 1997 (b) The
vulnerabilities distribution in year of 2018 by the risk level

Figure 4: The vulnerabilities distribution in ICS.

From Figure 4(b), we can see that, among the vulnerabilities published in
2018, most of them are at high-level risk for the ICS. Only 2.36% of them are
in low-level risk, which has the same trend that reported by Oxana et al.
[58].

Vulnerabilities can be exploited in any place of ICS, not only in its software
or firmware but also in tools that are associated with monitoring and auditing
processes. And most of the vulnerabilities are unknown. The components of
vulnerability, it can be divided into four types: system platform
vulnerability, communication module vulnerability, application software
vulnerability, and hardware vulnerability. The system platform is to provide
the base service for the ICS, which always refers to SCADA in ICS. The
communication module is the communication system in ICS, which includes the
communication protocols, bus, and I/O system, etc. Application software
denotes the software that associates with the SCADA function which includes
the management, production, storage, and operation. Hardware is the basic
component that supports the ICS, which is the device that includes the
circuits, RTU, etc. According to the function of vulnerability, vulnerability
can also be divided into buffer overflow, authentication bypass, cross-site
vulnerability, and sensitive information sniffing four categories. A buffer
overflow is an overflow of the legal boundary of a buffer caused by a
programming error. This type of vulnerability has been discovered in all of
the four components mentioned before. Authentication bypass is the
vulnerability that allows an attacker to gain access to information without
authentication and is always present in the system platform, communication
module, and application software. The cross-site vulnerability that allows an
attacker to inject insecure scripts into a server is always present on a
system platform, e.g., SCADA. Sensitive information sniffing is the
vulnerability that allows an attacker to obtain or remove sensitive
information from ICS. This vulnerability is always present in the
communication module. These four categories are not independent, and sometimes
these categories of vulnerabilities form a so-called chain vulnerability,
giving an attacker more opportunities to attack ICS [59].

Vulnerability modeling is an important work in vulnerability detection. One
simple detection way is to use a vulnerability database. A number of
vulnerability databases are available online, such as Common Vulnerabilities
and Exposures (CVE)101010http://cve.mitre.org/, Open Source Vulnerability
Database (OSVDB)111111http://osvdb.org/, National Vulnerability Database
(NVD)121212http://nvd.nist.gov/, China National Vulnerability Database
(CNVD)131313http://ics.cnvd.org.cn/, Security Focus’s vulnerability
database141414https://cirdb.cerias.purdue.edu/coopvdb/public/, and Public
Cooperative Vulnerability Database
(PCVD)151515http://www.securityfocus.com/vulnerabilities, etc. However,
detection with a vulnerability database has many limitations, including
description shortage in vulnerabilities’ presence, exploit-ability, and
effect, unreadable to machine etc. [60] Faced with these problems, Sufatrio et
al. [61] proposed the newly designed vulnerability database Movtraq, which is
machine-readable and can be directly applied to automated detection systems.
But this database still has some drawbacks: First of all, Movtraq relies on
Unix systems (RedHat and FreeBSD) to run and is not portable; Second, the
information it focuses on is unitary, which makes it difficult to make a
further application. Therefore, we urgently need a language that can describe
vulnerabilities completely. Open Vulnerability and Assessment Language
(OVAL)161616http://oval.mitre.org/index.html is a machine-readable XML-based
language that is defined by MITRE171717https://www.mitre.org/. There are three
parts in OVAL which are system information representation, machine state
expression (e.g., vulnerability, configuration, patch state, etc.), and
assessment results [62]. The vulnerabilities described by OVAL can be entered
directly into the scanner, but they have no information about their
exploitability and need to be checked manually. Based on OVAL, new
vulnerabilities modeling language DEpendability and Security by Enhanced
REConfigurability (DESEREC)181818http://www.deserec.eu/ [63] is designed. This
language can effectively describe the exploitation of vulnerabilities and has
been successfully applied to the automatic vulnerability detection system
[64].

As we know, there are lots of vulnerabilities scanning tools, such as
SARA191919http://www-arc.com/sara/,
SAINT202020http://www.saintcorporation.com/ and
Nessus212121http://www.nessus.org etc. In addition to these tools, search
engines such as Google222222http://www.google.com and
Shodan232323https://www.shodan.io/ can also be applied in vulnerabilities
detection [65]. But their limitation is that they provide few clues,
especially when faced with exploiting serial vulnerabilities on multiple hosts
[60]. To deal with such a situation, Manuel et al. [64] extended the OVAL by
introducing two new elements which are preconditions and postconditions.
Recently, Cheminod et al. [66] have applied high-level security policies to
modeling to make vulnerability detection more effective. Generally, the
vulnerabilities that these systems deal with are mainly in the system
platform, application software, and communication module.

In addition to vulnerability modeling, there are other methods for
vulnerability detection, such as virtual technology, Fuzzing test, etc.
Ashlesha et al. [67] designed a system IntroVirt based on vulnerability-
specific predicates in virtual-machine introspection to detect
vulnerabilities. IntroVirt can detect or respond to past and present
vulnerabilities. Xiong et al. [68] using the Fuzzing test to detect the
vulnerabilities in Modbus-TCP. Kim et al. [69] proposed a test case generation
technique for a fuzzing test that can be used for vulnerability detection in
industrial control system protocols. Luo et al. [70] proposed a functional
code-aware fuzzy identification framework Polar, which can automatically
extract semantic information from the ICS protocol and use this information to
accelerate vulnerability detection.

####  III-C2 Malware Detection

Unlike the passive threat invulnerability, the malware threat is active and
can be extremely disruptive to the system, such as Stunex [71]. We know that
malware has been discovered since the invention of computers. The openness of
ICS makes it more vulnerable to traditional malware infections. Andrea et al.
[72] have shown that ICS can be infected even without customized malware.
Malware refers to software or code intended to read, write, or change the
normal state of the ICS. It includes viruses, worms, Trojans, malicious code,
etc. Malware usually exploits vulnerabilities in ICS.

When doing malware detection in ICS, “real-time” is an important factor that
needs to concern, especially when ICS is in a production state. Some works
divide malware detection into two categories, one is anomaly-based detection
and the other one is signature-based detection [73, 74]. Anomaly-based
detection should know the normal and the abnormal behaviors that malware may
act on [75]. This approach requires the detection tool to know all the normal
behavior of the software in ICS. Signature-based detection, however, usually
tries to find common features of malware. This detection method can usually be
implemented by machine learning, rule-based systems, checksums, scanning
strings, etc. [76, 77]. Machida et al. [78] applied rule-based methods to lure
this malware into our sensors by continuously embedding sensor information
into the host list in the ICS network, and it successfully detected malware
like WannaCry and Conficker. In addition to these methods, formal languages
can also be used in malware detection. Saman et al. [79] detects the malware
automatically in the PLC through code analytics with formal language.
Generally, this method belongs to signature-based detection but with specific-
defined malware states informal language.

Anti-virus simulators were usually applied in the past, and they detected the
malware through the simulation of the behavior, such as Hirst’s Virus
Simulation Suite [80], Virlab [81], Nepenthes [82] etc. But all of those
projects are out of date and stopped updating ten years ago. Luis et al. [83]
designed the HARVEY system embedded in the PLC to detect the malicious command
that malware sends to PLC.

####  III-C3 Anomaly Traffic Detection

Another problem the ICS always faces is anomaly traffic, which is a kind of
intrusion over industrial networks. Because of the complexity of the ICS, it
is more difficult to do intrusion detection in the ICS than that on the
traditional Internet.

Intrusion Detection is a communication security technique that can detect,
identify, and respond to unauthorized operations, such as insert, delete,
query, and modify. There are three main principles for intrusion detection:
misuse-based, anomaly-based, and hybrid(combine the formers) [84].

The misuse-based method can be used to detect known attacks by the signatures
of these attacks. This technique can detect the known type of attacks
effectively, but it needs to manually update the database frequently, and
can’t detect novel attacks.

The anomaly-based method can identify anomalies from normal behavior by
modeling the normal network and system behavior. This method can detect
unknown attacks, but it has high false alarm rates because the unseen
behaviors may be identified as anomalies.

The hybrid method combines the misuse-based method and the anomaly-based
method and inherited their respective advantages. This method can decrease the
false positive(FP) rate for unknown attacks, and raise the detection rates of
known attacks.

The emergence of machine learning approaches makes Intrusion Detection face a
new opportunity, these approaches learn from the available data and mine the
unknown characteristics in the data. At present, The following machine
learning and data mining methods can be used in Intrusion Detection:
Artificial Neural Networks, Association Rules and Fuzzy Association Rules,
Bayesian Networks, Clustering, Decision Trees, Ensemble Learning, Evolutionary
Computation, Hidden Markov Models, Inductive Learning, Naive Bayes, Sequential
Pattern Mining and Support Vector Machine.

Using machine learning and data mining methods can extract the features of
network data effectively, so compared with the traditional network analysis
methods, they can obtain more satisfactory detection results. However, these
methods require a large amount of data when training the model. The larger the
amount of data, the better the classification effect. The network data
currently used can be obtained in the following ways.

Packet-Level Data: There are many protocols in the network, such as
Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet
Control Message Protocol (ICMP), Internet Gateway Management Protocol (IGMP),
etc. Users running these protocols generate the packet network traffic of the
network. The network packets can be captured by a specific application
programming interface (API) called pcap. Libpcap and WinPCap are the capture
software libraries of many network tools, including protocol analyzers, packet
sniffers, network monitors, network IDSs, and traffic generators.

NetFlow Data: Ciscos NetFlow version 5 defines a network flow as a
unidirectional sequence of packets with seven attributes: ingress interface,
source IP address, destination IP address, IP protocol, source port,
destination port, and IP type of service. Currently, there are 10 versions of
NetFlow. Versions 1 to 8 are similar, but version 9 and version 10 have an
important difference.

Public Data Sets: Some public data sets are commonly recognized and widely
used in intrusion detection research. The Defense Advanced Research Projects
Agency (DARPA) collected the datasets with the Massachusetts Institute of
Technology Lincoln Laboratory (MIT/LL) in
1998242424https://www.ll.mit.edu/r-d/datasets/1998-darpa-intrusion-detection-
evaluation-dataset. The later DARPA 1999
datasets252525https://www.ll.mit.edu/r-d/datasets/1999-darpa-intrusion-
detection-evaluation-dataset and KDD 99 datasets [85] were generated on the
DARPA 1998 datasets. These datasets lay the foundation for the application of
machine learning and data mining methods in Intrusion Detection.

###  III-D Software Defined Networks (SDN)

The advantages of breaching the physical boundary, being programmable, and
easily deploying make software-defined networks (SDN) become another promising
solution for ICS network security. There are two types of flow control units
in SDN, which are OpenFlow and optimalFlow respectively, which are named
software controllers.

Different ways to get ensure the security of the networks, some works think
the security matters from the network structure of SDN. Manuel et al. [86]
designed an active SDN switch architecture that is acting as a virtual
firewall. It accommodates different protocols and makes the management of the
ICS network efficient. Bela et al. [87] redesigned the ILP problem over the
SDN and built a hierarchical control plane over the ICS, and make the ICS
networks more secure and flexible. Graur [88] adopted the SDN developing a
controller which can be applied in reconfiguring the ICS network. Some works
adopted the IDS or IPS system besides the SDN to ensure security. Dong et al.
[89] applied the IDS system along with the IDS to defend the attacks from the
smart grid.

##  IV Conclusions

In this paper, we gave a comprehensive review of the recent research on ICS
network security. We first listed the network protocols that are mostly used
in the network and analyzed the probable vulnerabilities and their defense
methods. Then, we try to give a brief review of the defense in depth in ICS in
terms of data encryption, access control policy, and intrusion detection
system. Finally, we ended with the software-defined network which is one of
the promising research directions.

## References

  * [1] K. Stouffer, V. Pillitteri, S. Lightman, M. Abrams, and A. Hahn, “Guide to industrial control systems (ics) security,” _NIST Special Publication_ , vol. 800, p. 82, 2015.
  * [2] I. E. Commission _et al._ , “Iec 62443-4-1: 2018 security for industrial automation and control systems–part 4-1: Secure product development lifecycle requirements,” _International Electrotechnical Commission: Geneva, Switzerland_ , 2018.
  * [3] W. Knowles, D. Prince, D. Hutchison, J. F. P. Disso, and K. Jones, “A survey of cyber security management in industrial control systems,” _International journal of critical infrastructure protection_ , vol. 9, pp. 52–80, 2015.
  * [4] Y. Xu, Y. Yang, T. Li, J. Ju, and Q. Wang, “Review on cyber vulnerabilities of communication protocols in industrial control systems,” in _Energy Internet and Energy System Integration (EI2), 2017 IEEE Conference on_. IEEE, 2017, pp. 1–6.
  * [5] Y. You, J. Lee, J. Oh, and K. Lee, “A review of cyber security controls from an ics perspective,” in _2018 International Conference on Platform Technology and Service (PlatCon)_. IEEE, 2018, pp. 1–6.
  * [6] E. D. Knapp and J. T. Langill, _Industrial Network Security: Securing critical infrastructure networks for smart grid, SCADA, and other Industrial Control Systems_. Syngress, 2014.
  * [7] Z. Zhou, B. Chen, H. Wang, and Z. Fan, “Study on the evolutionary optimisation of the topology of network control systems,” _Enterprise Information Systems_ , vol. 4(3), pp. 247–264, 2010.
  * [8] B. Genge, P. Haller, and I. Kiss, “Cyber-security-aware network design of industrial control systems,” _IEEE Systems Journal_ , vol. 11(3), pp. 1373–1384, 2017.
  * [9] T. Müller and H. D. Doran, “Profinet real-time protection layer: performance analysis of cryptographic and protocol processing overhead,” in _2018 IEEE 23rd International Conference on Emerging Technologies and Factory Automation (ETFA)_ , vol. 1. IEEE, 2018, pp. 258–265.
  * [10] K.-H. Niemann, “It security extensions for profinet,” in _2019 IEEE 17th International Conference on Industrial Informatics (INDIN)_ , vol. 1. IEEE, 2019, pp. 407–412.
  * [11] I. Darwish, O. Igbe, O. Celebi, T. Saadawi, and J. Soryal, “Smart grid dnp3 vulnerability analysis and experimentation,” in _2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing_. IEEE, 2015, pp. 141–147.
  * [12] I. A. Siddavatam and F. Kazi, “Security assessment framework for cyber physical systems: A case-study of dnp3 protocol,” in _2015 IEEE Bombay Section Symposium (IBSS)_. IEEE, 2015, pp. 1–6.
  * [13] R. Amoah, S. Camtepe, and E. Foo, “Securing dnp3 broadcast communications in scada systems,” _IEEE Transactions on Industrial Informatics_ , vol. 12, no. 4, pp. 1474–1485, 2016.
  * [14] R. Nardone, R. J. Rodríguez, and S. Marrone, “Formal security assessment of modbus protocol,” in _2016 11th International Conference for Internet Technology and Secured Transactions (ICITST)_. IEEE, 2016, pp. 142–147.
  * [15] R. C.-W. Phan, “Authenticated modbus protocol for critical infrastructure protection,” _Ieee transactions on power delivery_ , vol. 27, no. 3, pp. 1687–1689, 2012.
  * [16] Y. Yang, K. McLaughlin, T. Littler, S. Sezer, B. Pranggono, and H. Wang, “Intrusion detection system for iec 60870-5-104 based scada networks,” in _2013 IEEE power & energy society general meeting_. IEEE, 2013, pp. 1–5.
  * [17] P. Maynard, K. McLaughlin, and B. Haberler, “Towards understanding man-in-the-middle attacks on iec 60870-5-104 scada networks,” in _2nd International Symposium for ICS & SCADA Cyber Security Research 2014 (ICS-CSR 2014) 2_, 2014, pp. 30–42.
  * [18] T. A. Youssef, M. El Hariri, N. Bugay, and O. Mohammed, “Iec 61850: Technology standards and cyber-threats,” in _2016 IEEE 16th International Conference on Environment and Electrical Engineering (EEEIC)_. IEEE, 2016, pp. 1–6.
  * [19] M. Kabir-Querrec, S. Mocanu, J.-M. Thiriet, and E. Savary, “A test bed dedicated to the study of vulnerabilities in iec 61850 power utility automation networks,” in _2016 IEEE 21st International Conference on Emerging Technologies and Factory Automation (ETFA)_. IEEE, 2016, pp. 1–4.
  * [20] T. H. Nguyen, A. Prinz, T. Friisø, and R. Nossum, “Smart grid for offshore wind farms: Towards an information model based on the iec 61400-25 standard,” in _2012 IEEE PES Innovative Smart Grid Technologies (ISGT)_. IEEE, 2012, pp. 1–6.
  * [21] N. Liu, J. Zhang, and W. Liu, “A security mechanism of web services-based communication for wind power plants,” _IEEE transactions on power delivery_ , vol. 23, no. 4, pp. 1930–1938, 2008.
  * [22] R. Khan, K. McLaughlin, D. Laverty, and S. Sezer, “Analysis of ieee c37. 118 and iec 61850-90-5 synchrophasor communication frameworks,” in _2016 IEEE power and energy society general meeting (PESGM)_. IEEE, 2016, pp. 1–5.
  * [23] S. Oh, H. Chung, S. Lee, K. Lee, S.-H. Kim, I.-Y. Lee, S. Kiyomoto, Y. Miyake, H. B. Choi, H. J. Yoon _et al._ , “Advanced protocol to prevent man-in-the-middle attack in scada system,” _International Journal of Security and Its Applications_ , vol. 8, no. 2, pp. 1–8, 2014.
  * [24] G. S. Sestito, A. C. Turcato, A. L. Dias, M. S. Rocha, M. M. da Silva, P. Ferrari, and D. Brandao, “A method for anomalies detection in real-time ethernet data traffic applied to profinet,” _IEEE Transactions on Industrial Informatics_ , vol. 14(5), pp. 2171–2180, 2018.
  * [25] J.-H. Yun, S.-H. Jeon, K.-H. Kim, and W.-N. Kim, “Burst-based anomaly detection on the dnp3 protocol,” _International Journal of Control and Automation_ , vol. 6(2), pp. 313–324, 2013.
  * [26] J. Bai, S. Hariri, and Y. Al-Nashif, “A network protection framework for dnp3 over tcp/ip protocol,” in _Computer Systems and Applications (AICCSA), 2014 IEEE/ACS 11th International Conference on_. IEEE, 2014, pp. 9–15.
  * [27] H. Li, G. Liu, W. Jiang, and Y. Dai, “Designing snort rules to detect abnormal dnp3 network data,” in _Control, Automation and Information Sciences (ICCAIS), 2015 International Conference on_. IEEE, 2015, pp. 343–348.
  * [28] S. N. Shinde and R. P. Shinde, “Cybersecurity for supervisory control and data acquisition,” in _Cyber Security: Proceedings of CSI 2015_. Springer, 2018, pp. 361–371.
  * [29] B. Schneier, “Description of a new variable-length key, 64-bit block cipher (blowfish),” in _International Workshop on Fast Software Encryption_. Springer, 1993, pp. 191–204.
  * [30] Y. Lu and T. Feng, “Research on trusted dnp3-bae protocol based on hash chain,” _EURASIP Journal on Wireless Communications and Networking_ , vol. 2018(1), p. 108, 2018.
  * [31] M. H. Collantes and A. L. Padilla, “Protocols and network security in ics infrastructures,” Spanish National CyberSecurity Institute, Tech. Rep., 2015\.
  * [32] E. Pricop, J. Fattahi, N. Parashiv, F. Zamfir, and E. Ghayoula, “Method for authentication of sensors connected on modbus tcp,” in _Control, Decision and Information Technologies (CoDIT), 2017 4th International Conference on_. IEEE, 2017, pp. 0679–0683.
  * [33] L. Fei, Z. Renbin, L. Gang, L. Sixian, and X. Fuhao, “Security authentication protocol of modbus/tcp based on hash chain and synchronization mechanism,” _Application Research of Computers_ , vol. 4, pp. 1169–1173, 2018.
  * [34] W. Yusheng, F. Kefeng, L. Yingxu, L. Zenghui, Z. Ruikang, Y. Xiangzhen, and L. Lin, “Intrusion detection of industrial control system based on modbus tcp protocol,” in _Autonomous Decentralized System (ISADS), 2017 IEEE 13th International Symposium on_. IEEE, 2017, pp. 156–162.
  * [35] Q. S. Qassim, N. Jamil, M. Daud, N. Ja’affar, S. Yussof, R. Ismail, and W. A. W. Kamarulzaman, “Simulating command injection attacks on iec 60870-5-104 protocol in scada system,” _International Journal of Engineering & Technology_, vol. 7, no. 2.14, pp. 153–159, 2018.
  * [36] E. Hodo, S. Grebeniuk, H. Ruotsalainen, and P. Tavolato, “Anomaly detection for simulated iec-60870-5-104 trafiic,” in _Proceedings of the 12th International Conference on Availability, Reliability and Security_ , 2017, pp. 1–7.
  * [37] P. Weerathunga, “Security aspects of smart grid communication (spine title: Security aspects of smart grid communication)(thesis format: Monograph),” Ph.D. dissertation, Western University London, 2012.
  * [38] M. A. Ahmed and Y.-C. Kim, “Hierarchical communication network architectures for offshore wind power farms,” _Energies_ , vol. 7, no. 5, pp. 3420–3437, 2014.
  * [39] I. E. Commission _et al._ , “Wind turbines part 24-3: Communications for monitoring and control of wind power plants information exchange models,” IEC 61400-25-3, Geneva, Switzerland, Tech. Rep., 2006.
  * [40] R. Khan, K. McLaughlin, D. M. Laverty, and S. Sezer, “Ieee c37. 118-2 synchrophasor communication framework-overview, cyber vulnerabilities analysis and performance evaluation.” in _ICISSP_ , 2016, pp. 167–178.
  * [41] J. Stewart, T. Maufer, R. Smith, C. Anderson, and E. Ersonmez, “Synchrophasor security practices,” in _14th annual georgia tech fault and disturbance analysis conference_ , vol. 38, 2011.
  * [42] S. Basumallik, S. Eftekharnejad, N. Davis, N. Nuthalapati, and B. K. Johnson, “Cyber security considerations on pmu-based state estimation,” in _Proceedings of the Fifth Cybersecurity Symposium_ , 2018, pp. 1–4.
  * [43] D. Coppersmith, “The data encryption standard (des) and its strength against attacks,” _IBM journal of research and development_ , vol. 38, no. 3, pp. 243–250, 1994.
  * [44] D. Coppersmith, D. B. Johnson, and S. M. Matyas, “A proposed mode for triple-des encryption,” _IBM Journal of Research and Development_ , vol. 40, no. 2, pp. 253–262, 1996.
  * [45] J. Daemen and V. Rijmen, “Reijndael: The advanced encryption standard.” _Dr. Dobb’s Journal: Software Tools for the Professional Programmer_ , vol. 26, no. 3, pp. 137–139, 2001.
  * [46] A. Popov, “Prohibiting rc4 cipher suites,” _Computer Science_ , vol. 2355, no. 152-164, p. 25, 2015.
  * [47] S. Xu, “Research of lightweight data security transmission for industrial control system,” Master’s thesis, Zhejiang University, 2016.
  * [48] D. Fauri, B. de Wijs, J. den Hartog, E. Costante, S. Etalle, and E. Zambon, “Encryption in ics networks: a blessing or a curse,” in _2017 IEEE International Conference on Smart Grid Communications_. IEEE Computer Society, 2017.
  * [49] H. Yoo, J.-H. Yun, and T. Shon, “Whitelist-based anomaly detection for industrial control system security,” _The Journal of Korean Institute of Communications and Information Sciences_ , vol. 38(8), pp. 641–653, 2013.
  * [50] B.-K. Kim, D.-H. Kang, J.-C. Na, and T.-M. Chung, “Abnormal traffic filtering mechanism for protecting ics networks,” in _Advanced Communication Technology (ICACT), 2016 18th International Conference on_. IEEE, 2016, pp. 436–440.
  * [51] P. J. Lee, H. Guo, and B. Veeravalli, “Enhancing cii firewall performance through hash based rule lookup,” in _Region 10 Conference, TENCON 2017-2017 IEEE_. IEEE, 2017, pp. 2285–2290.
  * [52] J. Peng and L. Liu, “Analysis of information security for industrial control system,” _Process Automation Instrumentation/Zidonghua Yibiao_ , vol. 33(12), pp. 36–39, 2012.
  * [53] W.-S. Jung, J.-H. Yun, S.-K. Kim, K.-S. Shim, and M.-S. Kim, “Structured whitelist generation in scada network using prefixspan algorithm,” in _Network Operations and Management Symposium (APNOMS), 2017 19th Asia-Pacific_. IEEE, 2017, pp. 326–326.
  * [54] R. R. R. Barbosa, R. Sadre, and A. Pras, “Flow whitelisting in scada networks,” _International journal of critical infrastructure protection_ , vol. 6(3-4), pp. 150–158, 2013.
  * [55] S. Choi, Y. Chang, J.-H. Yun, and W. Kim, “Traffic-locality-based creation of flow whitelists for scada networks,” in _International Conference on Critical Infrastructure Protection_. Springer, 2015, pp. 87–102.
  * [56] J. Nivethan and M. Papa, “A linux-based firewall for the dnp3 protocol,” in _Technologies for Homeland Security (HST), 2016 IEEE Symposium on_. IEEE, 2016, pp. 1–5.
  * [57] J. Yang, C. Zhou, S. Yang, H. Xu, and B. Hu, “Anomaly detection based on zone partition for security protection of industrial cyber-physical systems,” _IEEE Transactions on Industrial Electronics_ , vol. 65(5), pp. 4257–4267, 2018.
  * [58] O. Andreeva, S. Gordeychik, G. Gritsai, O. Kochetova, E. Potseluevskaya, S. I. Sidorov, and A. A. Timorin, “Industrial control systems vulnerabilities statistics,” _Kaspersky Lab, Report_ , 2016.
  * [59] J. Xu and D. Feng, “Identification of ics security risks toward the analysis of packet interaction characteristics using state sequence matching based on sf-fsm,” _Security and Communication Networks_ , vol. 2017, 2017.
  * [60] P. Maggi, D. Pozza, and R. Sisto, “Vulnerability modelling for the analysis of network attacks,” in _Dependability of Computer Systems, 2008. DepCos-RELCOMEX’08. Third International Conference on_. IEEE, 2008, pp. 15–22.
  * [61] Y. R. H. Sufatrio, L. Zhong _et al._ , “A machine-oriented integrated vulnerability database for automated vulnerability detection and processing,” _Large Installation System Administration (LISA)_ , 2004.
  * [62] J. Banghart, S. Quinn, and D. Waltermire, _Open vulnerability and assessment language (oval) validation program test requirements (draft)_. US Department of Commerce, National Institute of Standards and Technology, 2010.
  * [63] P. Pérez and B. Bruyère, “Deserec: Dependability and security by enhanced reconfigurability,” _European CIIP Newsletter_ , vol. 3, no. 1, 2007\.
  * [64] M. Cheminod, I. C. Bertolotti, L. Durante, P. Maggi, D. Pozza, R. Sisto, and A. Valenzano, “Detecting chains of vulnerabilities in industrial networks,” _IEEE Transactions on Industrial Informatics_ , vol. 5(2), pp. 181–193, 2009\.
  * [65] K. Simon, “Vulnerability analysis using google and shodan,” in _International conference on cryptology and network security_. Springer, 2016, pp. 725–730.
  * [66] M. Cheminod, L. Durante, L. Seno, and A. Valenzano, “Analysis of exploitable vulnerability sequences in industrial networked systems: a proof of concepts,” in _Proceedings of the 3rd International Symposium for ICS & SCADA Cyber Security Research_. BCS Learning & Development Ltd., 2015, pp. 63–72.
  * [67] A. Joshi, S. T. King, G. W. Dunlap, and P. M. Chen, “Detecting past and present intrusions through vulnerability-specific predicates,” in _ACM SIGOPS Operating Systems Review_ , vol. 39(5). ACM, 2005, pp. 91–104.
  * [68] Q. Xiong, H. Liu, Y. Xu, H. Rao, S. Yi, B. Zhang, W. Jia, and H. Deng, “A vulnerability detecting method for modbus-tcp based on smart fuzzing mechanism,” in _Electro/Information Technology (EIT), 2015 IEEE International Conference on_. IEEE, 2015, pp. 404–409.
  * [69] S. J. Kim and T. Shon, “Field classification-based novel fuzzing case generation for ics protocols,” _The Journal of Supercomputing_ , vol. 74, no. 9, pp. 4434–4450, 2018.
  * [70] Z. Luo, F. Zuo, Y. Jiang, J. Gao, X. Jiao, and J. Sun, “Polar: Function code aware fuzz testing of ics protocol,” _ACM Transactions on Embedded Computing Systems (TECS)_ , vol. 18, no. 5s, pp. 1–22, 2019.
  * [71] S. Karnouskos, “Stuxnet worm impact on industrial cyber-physical system security,” in _IECON 2011-37th Annual Conference on IEEE Industrial Electronics Society_. IEEE, 2011, pp. 4490–4494.
  * [72] A. Carcano, I. N. Fovino, M. Masera, and A. Trombetta, “Scada malware, a proof of concept,” in _International Workshop on Critical Information Infrastructures Security_. Springer, 2008, pp. 211–222.
  * [73] N. Idika and A. P. Mathur, “A survey of malware detection techniques,” _Purdue University_ , vol. 48, 2007.
  * [74] B. Zhu and S. Sastry, “Scada-specific intrusion detection/prevention systems: a survey and taxonomy,” in _Proceedings of the 1st Workshop on Secure Control Systems (SCS)_ , vol. 11, 2010, p. 7.
  * [75] D. Yang, A. Usynin, and J. W. Hines, “Anomaly-based intrusion detection for scada systems,” in _5th intl. topical meeting on nuclear plant instrumentation, control and human machine interface technologies (npic &hmit 05)_, 2006, pp. 12–16.
  * [76] A. S. Bist _et al._ , “Classification and identification of malicious codes,” _IJCSE_ , vol. 3(2), pp. 202–211, 2012.
  * [77] Y. Peng, J. Liang, and G. Xu, “Malware detection method for the industrial control systems,” in _2016 4th International Conference on Cloud Computing and Intelligence Systems (CCIS)_. IEEE, 2016, pp. 255–259.
  * [78] T. Machida, D. Yamamoto, Y. Unno, and H. Kojima, “Novel deception techniques for malware detection on industrial control systems.” _IACR Cryptol. ePrint Arch._ , vol. 2020, p. 255, 2020.
  * [79] S. Zonouz, J. Rrushi, and S. McLaughlin, “Detecting industrial control malware using automated plc code analytics,” _IEEE Security & Privacy_, vol. 12(6), pp. 40–47, 2014.
  * [80] J. Hirst, “Virus simulation suite,” _British Computer Virus Research Centre, Brighton, United Kingdom_ , 1990.
  * [81] T. Faistenhammer, M. Klöck, K. Klotz, T. Krüger, P. Reinisch, and J. Wagner, “Virlab 2.1,” _Geltendorf, Germany kklotz. de/html/virlab. html_ , 1993.
  * [82] P. Baecher, M. Koetter, T. Holz, M. Dornseif, and F. Freiling, “The nepenthes platform: An efficient approach to collect malware,” in _International Workshop on Recent Advances in Intrusion Detection_. Springer, 2006, pp. 165–184.
  * [83] L. Garcia, F. Brasser, M. H. Cintuglu, A.-R. Sadeghi, O. A. Mohammed, and S. A. Zonouz, “Hey, my malware knows physics! attacking plcs with physical model aware rootkit.” in _NDSS_ , 2017.
  * [84] A. L. Buczak and E. Guven, “A survey of data mining and machine learning methods for cyber security intrusion detection,” _IEEE Communications Surveys Tutorials_ , vol. 18, no. 2, pp. 1153–1176, Secondquarter 2016.
  * [85] M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, “A detailed analysis of the kdd cup 99 data set,” in _2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications_ , July 2009, pp. 1–6.
  * [86] M. Cheminod, L. Durante, L. Seno, F. Valenza, A. Valenzano, and C. Zunino, “Leveraging sdn to improve security in industrial networks,” in _Factory Communication Systems (WFCS), 2017 IEEE 13th International Workshop on_. IEEE, 2017, pp. 1–7.
  * [87] B. Genge and P. Haller, “A hierarchical control plane for software-defined networks-based industrial control systems,” in _2016 IFIP Networking Conference (IFIP Networking) and Workshops_. IEEE, 2016, pp. 73–81.
  * [88] F. Graur, “Dynamic network configuration in the internet of things,” in _Digital Forensic and Security (ISDFS), 2017 5th International Symposium on_. IEEE, 2017, pp. 1–4.
  * [89] X. Dong, H. Lin, R. Tan, R. K. Iyer, and Z. Kalbarczyk, “Software-defined networking for smart grid resilience: Opportunities and challenges,” in _Proceedings of the 1st ACM Workshop on Cyber-Physical System Security_. ACM, 2015, pp. 61–68.