Anomaly Based IDS Via Customised CUSUM Algorithm for Industrial Communication Systems

Industrial communication and applications have become more connected to the internet due to the enhancement of new 5G based technologies such as the Internet of Things (IoT), cloud computing, Big Data, remote monitoring, and industrial automation techniques. Such improvement has made factory plants more exposed to conventional and new cybersecurity threats. Unfortunately, the advancement in the production cycle elements has not been accompanied by similar progress in developing customised security solutions dedicated to industrial communication systems deployed inside the factory plant. This paper presents a new framework and mechanism that utilise existing components to provide feedback information that reflects the factory components' operation mode and load state. This enables anomaly-based behaviour of the system to be detected. A customised Cumulative Sum (CUSUM) with adaptive thresholds is proposed as part of the detection mechanism deployed by the IDS.