Optimization and implementation of industrial control system network intrusion detection by telemetry analysis

摘要

Industrial control systems (ICS) are related to all aspects of human life and have become the target of many cyber-attackers. Attacks on industrial control systems may not only cause monetary loss, but also damage equipment, the environment and hurt staff, such as the Stuxnet and the cyber attack on the Ukrainian power grid. So the intrusion detection of ICS has a great significance. This paper based on the intrusion detection by telemetry analysis, optimized the system model, captured the communication packets between different nodes in the system, then extracted features for machine learning to achieve malicious traffic detection, and the attack types are further distinguished. Telemetry means that it does not need to enter the industrial control system network, but by capturing data packets remotely to achieve intrusion detection.