Intrusion detection system framework for cyber-physical systems

Abstract

Cyber-Physical Systems (CPS) have become integral components across diverse sectors, including autonomous vehicle systems, healthcare, power distribution, and manufacturing. These systems leverage physical components enhanced with intelligent capabilities, enabling autonomous functionality and increased efficiency. Security is a critical concern for CPS due to their close integration with essential infrastructure, where failures can have severe consequences for both the physical environment and human lives. Intrusion Detection Systems (IDS) can be a vital tool for secure CPS, detecting and alerting against threats such as malicious activities. However, conventional IDS designs are often inadequate for CPS environments, typically focusing solely on the network (Network-based Intrusion Detection System or NIDS) or application layer (Host-based Intrusion Detection System or HIDS), while neglecting the physical layer. Therefore, this research proposes a novel IDS framework that employs a hybrid detection approach, along with comprehensive guidelines for intrusion detection specifically tailored to CPS. This initiative contributes towards establishing a cohesive IDS framework for CPS, empowering practitioners in navigating this domain and crafting bespoke intrusion detection solutions. The proposed approach has been rigorously evaluated through a comparative analysis of different methodologies, demonstrating the effectiveness of the guidelines and requirements in addressing all relevant security aspects for IDS design. This research provides CPS practitioners and researchers with actionable guidelines designed to effectively enhance the security posture of their systems. By implementing these guidelines, they can better protect against threats and mitigate their potential consequences, thereby contributing to the security of Industry 4.0. This proactive approach not only secure critical infrastructure but also fosters a more resilient and secure operational environment in the face of evolving cyber threats.