{'fraction_non_alphanumeric': 0.025995125913891144, 'fraction_numerical': 0.0, 'mean_word_length': 5.222222222222222, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Sbsd: Detecting the Sequence Attack through Sensor Data in ICSs

The Industrial Control System (ICS) refers to the national critical infrastructure, such as Energy and Water facility, which is significant for the national security. Sequence attack is a unique attack type in ICS, and many detection approaches have been proposed. A common and unrealistic hypothesis of these approaches is that they have gained the command sequences. In the real world, we can only obtain the observations from sensors. The single observation detection technique is a common approach to find anomalies by the observations. However, the highly skilled attacker can compromise some Programmable Logic Controllers (PLCs) in ICS and fake their sensor measurements. Under this circumstance, this detection approach becomes invalid and increases the false-negative rate. In this paper, we first analyze the sequence attack by their attack capability in ICS. Then we propose a State-Based Sequence Detection approach (SBSD). The SBSD uses the equipment's observation information, belonging to many PLCs, to create Hidden Markov Models (HMMs) for detecting the sequence attack. The experiment results in an ICS testbed have shown the effectiveness of SBSD.