Specification Mining for Intrusion Detection in Networked Control Systems
summary
Automatic extraction of BACnet-based specifications from device PICS and network traffic generates IDS rules and runs on a Bro/Zeek framework plus Python scrapers, achieving 98.6% device fingerprinting and 99.9% object coverage across two real sites (University of Twente, LBNL) over two months. The system finds undocumented/proprietary objects, forbidden properties and an unexpected writable property, surfaces operator misconfigurations, and relies on readable BACnet (encryption is rarely used).
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:25Network Intrusion Detection in a Nutshell
- 2:26Specification Mining Approach
- 3:44Networked Control Systems
- 4:57Building Automation Threats
- 6:39BACnet (Application Layer)
- 7:43Building Automation Documentation
- 9:50System Discovery
- 12:43Feature Lookup
- 13:41Rule Definition
- 15:56Detection Results
- 18:43Discussion
- 21:40Conclusions
related talks
39mImproving OT Network and Host Baselines to Secure Critical Infrastructure
43mOpen Source Intelligence Based Intrusion Detection System
24mA Study on Intrusion Detection Systems with a Practical Experiment on Snort
40mUncovering Covert Channels in Your IoT Networks
48mPutting an Intrusion Detection System to the Test
06mUsing Genetic Algorithms for Network Intrusion Detection and Integration into nProbe
41mTechniques for Automatic Device Identification and Network Assignment
29mDetection Engineering: Defending Networks with Purpose