Safeguarding SCADA Systems with Anomaly Detection - Computer Network Security - page 181

a SCADA system. Both techniques can identify whether a collection of readings from
the network is normal or abnormal with a reasonable false positive rate. On the detec-
tion of errors within each set of data readings, the two techniques have complemen-
tary strengths and the proposed combination of methods using a Bayesian network
should enable the limitations of the individual techniques to be overcome. In the
longer term these technologies will be incorporated into the Safeguard agent system
and used to protect electricity and telecommunications management networks.

OTHER
INFORMATION

N-GRAM
SCANNING

EQUATION
INDUCTION

R1 is in range/
out of range

R2 is in range/
out of range

R1 is correct/
incorrect

R2 is correct/
incorrect

Equation connecting
R1 and R2 holds/
does not hold

R1 is correct/ incorrect

R2 is correct/ incorrect

Fig. 9. A Bayesian network that correlates the output from different anomaly detectors with
other information. R1 and R2 are power readings

Acknowledgements

We would like to acknowledge Xuan Jin and the other members of the Safeguard
project. These include Wes Carter (QMUL), Stefan Burschka (Swisscom), Simin
Nadjm-Tehrani (LIU), Kalle Burbeck (LIU), Giordano Vicoli (ENEA), Sandro Bolo-
gna (ENEA), Claudio Balducelli (ENEA) and Carlos López Ullod (AIA). We would
also like to thank the European IST Programme for their support for this project.

References

1. Clements, K.A., Davis, P.W.: Detection and Identification of Topology Errors in Electric
Power Systems. IEEE Transactions on Power Systems , Vol. 3, No. 4, November 1988
2. CylantSecure, www.cylant.com
3. Damashek, Marc: Gauging Similarity with n-Grams: Language-Independent Categorization
of Text. Science , Vol. 267, 10 February 1995, pp. 843-848
4. dti (Department of Trade and Industry, UK). 'Information Security Breaches Survey 2002',
available at: https://www.security-survey.gov.uk/ isbs2002_detailedreport.pdf
5. D o, 'Discovering Dynamics: From Inductive Logic

Programming to Machine Discovery', Journal of Intelligent Systems , 4 (1994) 89-108
6. Ernst, Michael: Dynamically Discovering Likely Program Invariants , PhD Thesis, Univer-
sity of Washington 2000

eroski, Sašo and Todorovski, Ljup