ANOMALY-BASED INTRUSION DETECTION

摘要

Anomaly detection technology is used to detect attempts at remote tampering of communications used to control components of critical infrastructure. Intrusions in a control network are detected by monitoring operational traffic on the control network. Activity outside a normal region is identified, and alerts are provided as a function of identified activity outside the normal region. A stide algorithm may be used to identify such activity.