<?xml version="1.0" encoding="utf-8"?>
<export-example>
  <doc>
    <id>36990</id>
    <completedYear/>
    <publishedYear>2025</publishedYear>
    <thesisYearAccepted/>
    <language>eng</language>
    <pageFirst>314</pageFirst>
    <pageLast>315</pageLast>
    <pageNumber>2</pageNumber>
    <edition/>
    <issue/>
    <volume/>
    <type>image</type>
    <publisherName>IEEE</publisherName>
    <publisherPlace>Piscataway, NJ</publisherPlace>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>0</belongsToBibliography>
    <completedDate>2025-12-09</completedDate>
    <publishedDate>--</publishedDate>
    <thesisDateAccepted>--</thesisDateAccepted>
    <title language="eng">Poster: characterization of dominant and specific network patterns in industrial control systems</title>
    <abstract language="eng">The increasing digitization and interconnection of Industrial Control Systems (ICS) to the Internet render them susceptible to cyber attacks. Thus, a major line of research focuses on the design of reactive security solutions in the form of industrial intrusion detection systems, which aim to detect anomalies in a normal system operation. However, a crucial prerequisite for the accurate detection and localization of anomalies is the identification of typical traffic patterns that are exclusive to characterize the normal ICS behavior. Unlike previous work focusing on complex and protocol-dependent models, for characterizing ICS network traffic, in this work we propose simple, easy deployable, and effective rules for determining whether ICS network traffic, unlike traditional IT networks, remains stable over time. The main advantage of our rules is that they can be used to estimate the time required to identify the most dominant ICS traffic patterns in a given ICS. We show the efficacy of our rules by analyzing multiple ICS datasets with different industrial network protocols.</abstract>
    <parentTitle language="eng">2025 23rd International Symposium on Network Computing and Applications (NCA)</parentTitle>
    <identifier type="doi">10.1109/NCA67271.2025.00059</identifier>
    <identifier type="isbn">979-8-3315-7842-8</identifier>
    <enrichment key="Fprofil">1 Energiewende und Dekarbonisierung / Energy Transition and Decarbonisation</enrichment>
    <enrichment key="opus_doi_flag">true</enrichment>
    <enrichment key="opus_import_data">{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,28]],"date-time":"2025-11-28T07:21:07Z","timestamp":1764314467469,"version":"3.46.0"},"reference-count":10,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T00:00:00Z","timestamp":1762300800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T00:00:00Z","timestamp":1762300800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,11,5]]},"DOI":"10.1109\/nca67271.2025.00059","type":"proceedings-article","created":{"date-parts":[[2025,11,27]],"date-time":"2025-11-27T18:55:25Z","timestamp":1764269725000},"page":"314-315","source":"Crossref","is-referenced-by-count":0,"title":["Poster: Characterization of Dominant and Specific Network Patterns in Industrial Control Systems"],"prefix":"10.1109","author":[{"given":"Asya","family":"Mitseva","sequence":"first","affiliation":[{"name":"Brandenburg University of Technology,Chair of IT Security,Cottbus,Germany"}]},{"given":"Marco","family":"Lewandowsky","sequence":"additional","affiliation":[{"name":"Brandenburg University of Technology,Chair of IT Security,Cottbus,Germany"}]},{"given":"Andriy","family":"Panchenko","sequence":"additional","affiliation":[{"name":"Brandenburg University of Technology,Chair of IT Security,Cottbus,Germany"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2012.6211945"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-28537-0_13"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/ETFA.2012.6489745"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2016.02.004"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SmartGridComm.2014.7007760"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-69781-5_14"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3198458.3198460"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2023.100612"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-25460-4_22"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.5220\/0006639801080116"}],"event":{"name":"2025 23rd International Symposium on Network Computing and Applications (NCA)","start":{"date-parts":[[2025,11,5]]},"location":"Lisbon, Portugal","end":{"date-parts":[[2025,11,7]]}},"container-title":["2025 23rd International Symposium on Network Computing and Applications (NCA)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11261527\/11261546\/11261588.pdf?arnumber=11261588","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,28]],"date-time":"2025-11-28T07:16:59Z","timestamp":1764314219000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11261588\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,5]]},"references-count":10,"URL":"https:\/\/doi.org\/10.1109\/nca67271.2025.00059","relation":{},"subject":[],"published":{"date-parts":[[2025,11,5]]}}}</enrichment>
    <enrichment key="opus_crossrefDocumentType">proceedings-article</enrichment>
    <enrichment key="local_crossrefLicence">https://doi.org/10.15223/policy-029</enrichment>
    <enrichment key="local_import_origin">crossref</enrichment>
    <enrichment key="local_doiImportPopulated">PersonAuthorFirstName_1,PersonAuthorLastName_1,PersonAuthorFirstName_2,PersonAuthorLastName_2,PersonAuthorFirstName_3,PersonAuthorLastName_3,EnrichmentConferenceTitle,EnrichmentConferencePlace,PublisherName,TitleMain_1,TitleParent_1,PageNumber,PageFirst,PageLast,PublishedYear,Enrichmentlocal_crossrefLicence</enrichment>
    <enrichment key="BTU">an der BTU erstellt / created at BTU</enrichment>
    <enrichment key="Referiert">Beitrag ist referiert / Article peer-reviewed</enrichment>
    <enrichment key="ConferencePlace">Lisbon, Portugal</enrichment>
    <enrichment key="ConferenceTitle">2025 23rd International Symposium on Network Computing and Applications (NCA)</enrichment>
    <enrichment key="Publikationsweg">Open Access</enrichment>
    <enrichment key="RelationnotEU">12059002, 12059500</enrichment>
    <enrichment key="BTUfunderNamenotEU">Bundesministerium für ­Forschung, Technologie und Raumfahrt (BMFTR), ILB Bund</enrichment>
    <enrichment key="opus.source">doi-import</enrichment>
    <enrichment key="opus.doi.autoCreate">false</enrichment>
    <enrichment key="opus.urn.autoCreate">false</enrichment>
    <author>
      <firstName>Asya</firstName>
      <lastName>Mitseva</lastName>
    </author>
    <submitter>
      <firstName>Katrin</firstName>
      <lastName>Willhöft</lastName>
    </submitter>
    <author>
      <firstName>Marco</firstName>
      <lastName>Lewandowsky</lastName>
    </author>
    <author>
      <firstName>Andriy</firstName>
      <lastName>Panchenko</lastName>
    </author>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Industrial Control Systems</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Traffic Patterns</value>
    </subject>
    <collection role="institutes" number="1205">FG IT-Sicherheit</collection>
  </doc>
  <doc>
    <id>37963</id>
    <completedYear/>
    <publishedYear>2026</publishedYear>
    <thesisYearAccepted/>
    <language>deu</language>
    <pageFirst>103</pageFirst>
    <pageLast>114</pageLast>
    <pageNumber>12</pageNumber>
    <edition/>
    <issue/>
    <volume/>
    <type>conferenceobject_ref</type>
    <publisherName>Gesellschaft für Informatik</publisherName>
    <publisherPlace>Bonn</publisherPlace>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>0</belongsToBibliography>
    <completedDate>2026-03-24</completedDate>
    <publishedDate>--</publishedDate>
    <thesisDateAccepted>--</thesisDateAccepted>
    <title language="deu">Whitelisting als Allheilmittel : über die Grenzen der Anomalieerkennung in industriellen Steuerungssystemen</title>
    <abstract language="deu">Die zunehmende Digitalisierung und Vernetzung industrieller Steuerungssysteme mit dem Internet macht diese anfällig für Cyberangriffe. Ein zentraler Forschungsbereich konzentriert sich daher auf die Entwicklung reaktiver Sicherheitsmechanismen in Form industrieller Intrusion-Detection-Systeme (IIDS), die darauf ausgelegt sind, Anomalien im normalen Systembetrieb zu erkennen. Eine entscheidende Voraussetzung hierfür ist die Identifizierung typischer Verkehrsmuster, die ausschließlich für das normale Verhalten industrieller Steuerungssysteme charakteristisch sind. Im Gegensatz zu früheren Arbeiten, die sich auf komplexe und protokollabhängige Modelle zur Charakterisierung des Netzwerkverkehrs industrieller Steuerungssysteme konzentrierten, schlagen wir in dieser Arbeit einfache, leicht umsetzbare und effektive Regeln vor, um zu ermitteln, ob der Netzwerkverkehr in Industrieanlagen – im Gegensatz zu herkömmlichen IT-Netzwerken – über einen längeren Zeitraum stabil bleibt. Anhand der Analyse mehrerer Datensätze aus nachgebildeten und realen industriellen Steuerungssystemen mit unterschiedlichen industriellen Netzwerkprotokollen zeigen wir, dass aufbauend auf diesen Regeln bereits nach kurzer Beobachtungszeit hinreichend prägnante Muster extrahiert werden können, mit deren Hilfe es möglich ist, gängige Verkehrsveränderungen durch Netzverkehrsangriffe zu erkennen. Dieser Ansatz steht im Gegensatz zu herkömmlichen Machine-Learning-IIDS, die häufig einen beträchtlichen zeitlichen Aufwand für den Trainingsprozess erfordern. Somit stellen wir auch die Frage auf, inwieweit komplexe IIDS für den praktischen Betrieb tatsächlich unabdingbar sind.</abstract>
    <parentTitle language="deu">Sicherheit 2026 : Sicherheit, Schutz und Zuverlässigkeit, 17.-19. März 2026, Hamburg : proceedings</parentTitle>
    <identifier type="issn">2944-7682</identifier>
    <identifier type="url">https://dl.gi.de/items/7b5e1e96-dad3-4843-aca7-77593cd8ddde</identifier>
    <identifier type="doi">10.18420/sicherheit2026_09</identifier>
    <enrichment key="Fprofil">1 Energiewende und Dekarbonisierung / Energy Transition and Decarbonisation</enrichment>
    <enrichment key="UBICOseries">GI-Edition. Proceedings (Lecture Notes in Informatics (LNI)) ; P379</enrichment>
    <enrichment key="BTU">an der BTU erstellt / created at BTU</enrichment>
    <enrichment key="RelationnotEU">12059002</enrichment>
    <enrichment key="BTUfunderNamenotEU">Bund, BMFTR</enrichment>
    <enrichment key="opus.source">publish</enrichment>
    <enrichment key="Publikationsweg">Open Access</enrichment>
    <licence>Creative Commons - CC BY-SA - Namensnennung - Weitergabe unter gleichen Bedingungen 4.0 International</licence>
    <author>
      <firstName>Asya</firstName>
      <lastName>Mitseva</lastName>
    </author>
    <editor>
      <firstName>Volker</firstName>
      <lastName>Skwarek</lastName>
    </editor>
    <submitter>
      <firstName>Katrin</firstName>
      <lastName>Willhöft</lastName>
    </submitter>
    <author>
      <firstName>Marco</firstName>
      <lastName>Lewandowsky</lastName>
    </author>
    <editor>
      <firstName>Kai Hendrik</firstName>
      <lastName>Wöhnert</lastName>
    </editor>
    <author>
      <firstName>Andriy</firstName>
      <lastName>Panchenko</lastName>
    </author>
    <editor>
      <firstName>Sascha</firstName>
      <lastName>Kaven</lastName>
    </editor>
    <editor>
      <firstName>Steffen</firstName>
      <lastName>Wendzel</lastName>
    </editor>
    <subject>
      <language>deu</language>
      <type>uncontrolled</type>
      <value>Steuerungssysteme</value>
    </subject>
    <subject>
      <language>deu</language>
      <type>uncontrolled</type>
      <value>Datenverkehrsmuster</value>
    </subject>
    <subject>
      <language>deu</language>
      <type>uncontrolled</type>
      <value>Datensätze</value>
    </subject>
    <subject>
      <language>deu</language>
      <type>uncontrolled</type>
      <value>Intrusion-Detection-Systeme</value>
    </subject>
    <collection role="institutes" number="1205">FG IT-Sicherheit</collection>
  </doc>
</export-example>
