Securing the Shop Floor: The Hard Road to ICS Intrusion Detection

by

Author: Denis Avetisyan

Developing robust security for industrial control systems requires more than just applying conventional methods, and this review highlights the significant hurdles in achieving truly holistic intrusion detection.

Holistic industrial intrusion detection systems comprehensively monitor both network activity and physical process states, a significant advancement over traditional systems limited to a single domain of observation.
Holistic industrial intrusion detection systems comprehensively monitor both network activity and physical process states, a significant advancement over traditional systems limited to a single domain of observation.

This paper examines the challenges of process state discretization, parameterization, and data acquisition in dynamic industrial environments for effective ICS security monitoring.

Despite increasing concerns regarding cyber-physical attacks, securing industrial control systems (ICS) remains challenging due to the need to correlate anomalies across both network and process layers. This paper, ‘On the Challenges of Holistic Intrusion Detection in ICS’, details obstacles encountered while developing a comprehensive intrusion detection system capable of addressing these interconnected dimensions. Specifically, we identify significant hurdles in effectively discretizing continuous process variables, accurately parameterizing complex system behaviors, and acquiring sufficient labeled training data within dynamic operational environments. How can we best bridge the gap between theoretical holistic detection approaches and practical, deployable ICS security solutions?

The Evolving Landscape of Industrial Control Systems

Historically, industrial control systems operated under the premise of predictable, or deterministic, behavior within physically segregated networks. This foundational assumption – that control systems were air-gapped from external influences and functioned with unwavering consistency – allowed for simplified security models. However, modern industrial environments are rapidly evolving. The integration of IT and OT networks, the proliferation of wireless technologies, and the increasing adoption of dynamic, interconnected systems have fundamentally altered this landscape. Consequently, the deterministic behavior once reliably expected is now compromised by external factors and inherent system variability, demanding a re-evaluation of traditional security approaches built upon the notion of isolated, predictable control environments.

The proliferation of wireless communication and increasingly dynamic systems within industrial control systems presents significant challenges to effective intrusion detection. Traditional security models relied on predictable network behavior, but these newer deployments introduce substantial variability, hindering the collection of consistent and reliable training data for machine learning algorithms. Research indicates a markedly higher standard deviation σ across all network links in wireless scenarios compared to wired or hybrid environments, reflecting this increased unpredictability. This heightened variance complicates the accurate identification of anomalous activity, as legitimate fluctuations can more easily be mistaken for malicious intrusions, and vice versa, demanding more sophisticated analytical techniques capable of discerning true threats amidst inherent system noise.

The foundational principles of industrial cybersecurity are undergoing a critical reevaluation as conventional intrusion detection systems prove increasingly inadequate. Historically, these systems relied on identifying known malicious patterns – or signatures – to flag potential threats. However, the accelerating sophistication of attacks, coupled with the expanding attack surface of modern industrial control systems, renders this approach vulnerable. Novel threats, designed to evade established signatures, can now penetrate defenses undetected. This necessitates a paradigm shift towards more adaptive and intelligent security solutions, capable of recognizing anomalous behavior and predicting potential attacks, rather than simply reacting to known ones. A focus on behavioral analysis and machine learning becomes paramount in safeguarding critical infrastructure against the evolving threat landscape.

Effective defense of critical infrastructure now necessitates a paradigm shift toward comprehensive systems that correlate network activity with actual process behavior. Traditional security measures, focused solely on identifying malicious network packets, are increasingly insufficient as attacks become more sophisticated and target the physical processes themselves. A truly resilient system requires the ability to monitor not just what data is traversing the network, but also how that data impacts the controlled physical environment – detecting anomalies in temperature, pressure, flow rates, or other process variables. This holistic approach enables the identification of attacks that might otherwise go unnoticed, such as subtle manipulations of control signals designed to cause gradual damage or disrupt operations, and offers a more nuanced understanding of legitimate operational deviations from attackers’ malicious actions.

Bridging the Network-Process Gap: A Holistic Approach

Holistic intrusion detection systems (IIDS) for industrial control systems (ICS) represent a shift from traditional network-centric security by incorporating monitoring of the physical process itself. These systems correlate network communications with data reflecting the actual operational state of the controlled process, such as sensor readings indicating temperature, pressure, or flow rates. This combined analysis allows for the detection of anomalies that might not be apparent when examining network traffic alone-for example, a network command instructing a valve to open when process sensors indicate it is already fully open. By providing visibility into both the digital and physical layers, holistic IIDS aim to improve the accuracy of intrusion detection and reduce false positives, offering a more comprehensive understanding of system behavior and potential security breaches.

Process mining within the context of holistic IIDS utilizes data from both network communications and physical process variables to construct models representing typical system behavior. This technique goes beyond simple anomaly detection by attempting to discover, monitor, and improve real processes as they are, rather than relying on pre-defined rules or signatures. By correlating network activity – such as Modbus TCP commands or Ethernet/IP transactions – with corresponding changes in process values like temperature, pressure, or valve position, process mining algorithms can identify deviations from established patterns. These patterns are often represented as process models, frequently employing techniques like Petri nets or state transition diagrams, enabling the system to understand not just that something unusual occurred, but how it deviates from normal operational sequences.

Process state discretization is a critical challenge in applying process mining to Industrial Control Systems (ICS) due to the prevalence of continuous sensor data – values that exist on a spectrum, such as temperature or pressure readings. Process mining algorithms typically operate on discrete event logs, necessitating the conversion of these continuous values into distinct, understandable states. This involves defining boundaries or thresholds that categorize continuous data into a finite set of labels representing specific process conditions – for example, classifying a temperature reading as “low,” “normal,” or “high.” The accuracy and effectiveness of process mining are directly impacted by the method used for discretization; poorly defined boundaries can lead to inaccurate process models and the misidentification of anomalies, while overly granular discretization can introduce excessive complexity and noise.

The implementation of holistic IIDS, integrating network and process monitoring, is significantly complicated by the parameterization requirements of the underlying models. These systems often utilize complex algorithms – such as stateful process mining or machine learning classifiers – that necessitate a substantial number of parameters to accurately reflect the ICS environment. Defining these parameters-including thresholds, weighting factors, and model configurations-requires deep domain expertise and extensive datasets for training and validation. Incorrect or poorly tuned parameters can lead to high false positive rates, missed detections, and ultimately, a compromised security posture. Furthermore, the dynamic nature of ICS environments necessitates ongoing parameter recalibration to account for process variations, equipment aging, and evolving attack vectors, increasing the operational burden and demanding automated parameter optimization techniques.

The Promise of Closed-Box Modeling with Large Language Models

Traditional intrusion detection systems (IIDS) rely heavily on manual parameterization, requiring security experts to define thresholds and signatures for normal and malicious activity. Closed-box modeling, specifically leveraging large language models (LLMs), presents an alternative by automating this process. LLMs are trained on system data to learn inherent patterns and establish a baseline of expected behavior without requiring explicit configuration of parameters by human analysts. This approach reduces the burden of maintaining and updating IIDS rules, and potentially improves detection accuracy by dynamically adapting to evolving system characteristics and subtle anomalies that might be missed by static, pre-defined parameters.

Large language models (LLMs) demonstrate the capacity to identify and interpret intricate patterns within operational data without requiring pre-defined rules or manually configured parameters. This capability stems from their training on extensive datasets, enabling them to develop a statistical understanding of normal system behavior and deviations indicative of malicious activity. Consequently, LLM-based intrusion detection systems (IIDS) offer the potential to generalize beyond known attack signatures and adapt to previously unseen or zero-day threats by reasoning about anomalous behavior based on learned patterns, rather than relying on explicit threat definitions. This adaptive reasoning is achieved through the model’s ability to contextualize data and infer relationships, facilitating the detection of subtle or complex attacks that might evade signature-based systems.

Evaluation of large language model (LLM)-based intrusion detection systems (IIDS) is currently undertaken using established datasets, notably the Secure Water Treatment (SWaT) dataset. This dataset, comprised of labeled network traffic data from a simulated water treatment facility, provides a standardized benchmark for assessing the efficacy of LLM-based IIDS against known attack vectors. Utilizing SWaT allows for direct performance comparison between LLM approaches and traditional signature-based or anomaly-detection IIDS, quantifying metrics such as detection rate, false positive rate, and precision. The availability of a common dataset facilitates reproducibility and objective assessment of advancements in LLM-driven cybersecurity solutions.

Implementation of LLM-based intrusion detection systems (IIDS) currently faces substantial resource constraints. Experimental results demonstrate that model execution necessitates a minimum of 96GB of VRAM, primarily due to the parameter size of the LLM and the computational demands of inference. This high VRAM requirement prohibits deployment on standard hardware configurations commonly found in security operations centers and limits scalability for analyzing large volumes of network traffic. Consequently, despite potential performance benefits, the practical application of these closed-box LLM approaches is currently hindered by the significant computational cost.

Towards Adaptive and Resilient Industrial Control System Security

A notable advancement in industrial control system (ICS) security lies in the synergistic combination of holistic intrusion detection systems (IIDS), process mining, and closed-box modeling techniques. Traditional IIDS often rely on signature-based detection, proving inadequate against novel attacks; however, integrating process mining – which analyzes system logs to understand normal operational behavior – provides crucial context. This contextual understanding then informs closed-box models, such as machine learning algorithms, capable of identifying anomalies indicative of malicious activity without requiring pre-defined signatures. The convergence of these approaches moves beyond simply detecting intrusions to predicting potential vulnerabilities and adapting security measures in real-time, fostering a more resilient and proactive defense against increasingly sophisticated cyber threats targeting critical infrastructure.

Traditional timing-based intrusion detection systems, which monitor the predictable execution of industrial control system processes, continue to offer a valuable first line of defense; however, their efficacy is increasingly challenged by the sophistication of modern threats and the growing complexity of industrial networks. These systems, while adept at identifying deviations from established temporal patterns, often struggle with nuanced attacks or those employing techniques like process masquerading. Consequently, integrating timing analysis with advanced methods – such as machine learning-driven anomaly detection, behavioral modeling, and deep packet inspection – becomes crucial. This layered approach enables a more comprehensive understanding of system behavior, allowing for the identification of both known and zero-day exploits, and ultimately bolstering the resilience of critical infrastructure against increasingly targeted cyberattacks. The synergy between established timing principles and cutting-edge technologies promises a robust and adaptable security posture for industrial control systems.

Effective implementation of advanced intrusion detection and process monitoring in industrial control systems necessitates a fundamental change in security strategy. Historically, ICS security has largely focused on reactive threat detection – identifying malicious activity after it has begun. However, a proactive approach prioritizes identifying vulnerabilities and potential risks before exploitation. This involves comprehensive risk assessment, modeling potential attack vectors, and implementing preventative measures such as system hardening, network segmentation, and robust access controls. Shifting to this paradigm allows for the anticipation of threats, the minimization of potential damage, and a significantly enhanced security posture, ultimately fostering a more resilient and adaptive ICS environment capable of withstanding increasingly sophisticated cyberattacks.

Continued advancement in industrial control system (ICS) security hinges on refining the ‘black box’ nature of many contemporary machine learning models. While these closed-box approaches demonstrate promise in anomaly detection, their lack of transparency hinders trust and effective response from operators. Future research must prioritize techniques that illuminate the reasoning behind model decisions, allowing security personnel to validate alerts and understand potential attack vectors. Simultaneously, static models are insufficient against the evolving threat landscape; therefore, developing methods for continuous learning and adaptation is crucial. This includes exploring techniques like online learning, reinforcement learning, and transfer learning to enable systems to automatically update their understanding of normal system behavior and proactively defend against novel attacks, ultimately bolstering the resilience of critical infrastructure.

The pursuit of comprehensive intrusion detection within Industrial Control Systems, as detailed in the study, inherently confronts the problem of reducing complex reality to manageable parameters. This mirrors a fundamental principle of efficient system design. As Tim Bern-Lee stated, “The web as I envisaged it, we have not seen it yet. The future is still so much bigger than the past.”. The article highlights the difficulties in discretizing process states and securing adequate training data – a clear indication that the initial vision of seamless ICS security remains largely unrealized. The challenge lies not merely in collecting data, but in distilling it into a form that allows for meaningful analysis, a process demanding ruthless simplification without sacrificing essential fidelity. This simplification, though necessary, presents a constant tension between model accuracy and computational feasibility.

Where Do We Go From Here?

The pursuit of holistic intrusion detection in Industrial Control Systems, as this work illustrates, often resembles building a cathedral out of sand. Each added layer of complexity – the necessary discretization of process states, the endless parameterization, the insatiable hunger for training data – feels less like progress and more like a delaying action against inevitable erosion. They called it ‘holistic’; one suspects it was a framework to hide the panic.

The central difficulty isn’t a lack of algorithms, but a surfeit. The problem isn’t that systems are too simple to model, but that they are so relentlessly, beautifully complex. Future work will likely not focus on more detection methods, but on methods for radical simplification. The ability to distill the essential signal from the noise, to define ‘normal’ with brutal economy, will prove far more valuable than any exquisitely tuned anomaly detector.

Wireless communication introduces further entropy, a delightful complication. But even here, the answer isn’t more encryption, or more layers of authentication. It’s accepting that perfect security is an illusion, and focusing on resilient systems – systems that fail gracefully, and reveal their failures quickly. The elegance, one suspects, will be in the subtraction.

Original article: https://arxiv.org/pdf/2604.21626.pdf

Contact the author: https://www.linkedin.com/in/avetisyan/

See also:

2026-04-25 09:59