Subtree Hypergraph-Based Attack Detection Model for Signature Matching over SCADA HMI

Layered inter-network communications, and dynamic control mechanisms of intra-connected testbeds in cyber-physical systems (CPS) paves way for controlling the PLCs and HMIs in a distributive manner. This intuits the idea of monitoring and logging the CPS traffic by embedding the motorized sensor/actuator readings into an IP-network packet. Attackers commence the network packet intervention of a CPS traffic as an initial phase for launching cyber-based attacks over critical public infrastructures. Log sequences captured for such an instance, required the security professional to observe the log sub-sequences that might possibly lead to an attack, unlisted in the signature repository of the existing defense mechanisms. Hence, this paper defines a hypergraph based attack detection model where constraints can be parameterized based on the type of CPS traffic in order to provide adaptable degree of representing possible attack incidents for the existing intrusion detection systems. Post defining the model’s parameterized constraints; we study the attack scenarios over Secure Water Treatment (SWaT) dataset from SUTD’s iTrust lab.