InformaApp - Publikationen

With more and more industrial devices getting inter-connected the attack surface for cyber attacks is increasing steadily. In this paper the possible approach of an attacker who got access to the office network at the Institute for Precision Manufacturing and High-Frequency Technology (IPH) to attack one of the optic machines that reside in another network segment is presented. Based on known vulnerabilities from the Common Vulnerabilities and Exposures (CVE), like the shellshock exploit or remote code execution with PsExec, for devices identified in the network, an attacker can bypass the firewall between the office network and the laboratory network and get full access to the HMI of the target machine.

Digital Institut ProtectIT TC Grafenau

Zeitschriftenartikel

Karl Leidl, Robert Hable, Michael Fernandes, Nari Arunraj, Michael Heigl

Comparison of Supervised, Semi-supervised and Unsupervised Learning Methods in Network Intrusion Detection Systems (NIDS) Application

Anwendungen und Konzepte in der Wirtschaftsinformatik (AKWI), no. 6, pp. 10-19

2017

Abstract anzeigen

With the emergence of the fourth industrial revolution (Industrie 4.0) of cyber physical systems, intrusion detection systems are highly necessary to detect industrial network attacks. Recently, the increase in application of specialized machine learning techniques is gaining critical attention in the intrusion detection community. A wide variety of learning techniques proposed for different network intrusion detection system (NIDS) problems can be roughly classified into three broad categories: supervised, semi-supervised and unsupervised. In this paper, a comparative study of selected learning methods from each of these three kinds is carried out. In order to assess these learning methods, they are subjected to investigate network traffic datasets from an Airplane Cabin Demonstrator. In addition to this, the imbalanced classes (normal and anomaly classes) that are present in the captured network traffic data is one of the most crucial issues to be taken into consideration. From this investigation, it has been identified that supervised learning methods (logistic and lasso logistic regression methods) perform better than other methodswhen historical data on former attacks are available. The results of this study have also showed that the performance of semi-supervised learning method (One class support vector machine) is comparatively better than unsupervised learning method (Isolation Forest) when historical data on former attacks are not available.

Elektrotechnik und Medientechnik Institut ProtectIT

Vortrag

Andreas Grzemba, Martin Schramm, Karl Leidl

The Establishment of High Degrees of Trust in a Linux Environment

Embedded World International Conference 2012, Nürnberg

2012

Digital Elektrotechnik und Medientechnik Institut ProtectIT

Vortrag

Karl Leidl

Anomalieerkennung in industriellen Netzwerken - Cybersicherheit mit Machine Learning

Forum Künstliche Intelligenz, Stuttgart

Digital Elektrotechnik und Medientechnik Institut ProtectIT