@misc{MitsevaLewandowskyPanchenko, author = {Mitseva, Asya and Lewandowsky, Marco and Panchenko, Andriy}, title = {Poster: characterization of dominant and specific network patterns in industrial control systems}, series = {2025 23rd International Symposium on Network Computing and Applications (NCA)}, journal = {2025 23rd International Symposium on Network Computing and Applications (NCA)}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {979-8-3315-7842-8}, doi = {10.1109/NCA67271.2025.00059}, pages = {314 -- 315}, abstract = {The increasing digitization and interconnection of Industrial Control Systems (ICS) to the Internet render them susceptible to cyber attacks. Thus, a major line of research focuses on the design of reactive security solutions in the form of industrial intrusion detection systems, which aim to detect anomalies in a normal system operation. However, a crucial prerequisite for the accurate detection and localization of anomalies is the identification of typical traffic patterns that are exclusive to characterize the normal ICS behavior. Unlike previous work focusing on complex and protocol-dependent models, for characterizing ICS network traffic, in this work we propose simple, easy deployable, and effective rules for determining whether ICS network traffic, unlike traditional IT networks, remains stable over time. The main advantage of our rules is that they can be used to estimate the time required to identify the most dominant ICS traffic patterns in a given ICS. We show the efficacy of our rules by analyzing multiple ICS datasets with different industrial network protocols.}, language = {en} }