Depending on the amount of data to process, file generation may take longer.

If it takes too long to generate, you can limit the data by, for example, reducing the range of years.

Article

Download BibTeX

Title

SCADvanceXP – an intelligent Polish system for threat detection and monitoring of industrial networks

Authors

[ 1 ] Instytut Informatyki, Wydział Informatyki i Telekomunikacji, Politechnika Poznańska | [ P ] employee | [ D ] phd student

Year of publication

2024

Published in

Security and Defence Quarterly

Journal year: 2024 | Journal volume: vol. 48 | Journal number: no. 4

Article type

scientific article

Publication language

english

Keywords
EN
  • malware
  • anomaly detection
  • cybersecurity
  • intrusion detection systems
  • industrial networks
Abstract

EN SCADvanceXP is an industrial network intrusion detection system that scans and monitors data exchange between engineering stations, field divides, controllers, SCADA and other elements of the OT network in detail. SCADvanceXP has the potential to detect advanced attacks on industrial infrastructures with the use of rule-based, signature-based and behavioural detection methods, which are supported by sophisticated machine and deep learning models. As a system developed in Poland, it addresses the needs of industry in that region of Europe. The goal of this work was to assess SCADvanceXP’s potential to detect common industrial threats. In order to check SCADvanceXP’s potential, an effort was undertaken to evaluate its functionally on major industrial threats. For that purpose, 12 malware strains interfering with industrial systems were described. Later, the SCADvanceXP functionality was overlapped on malware behavioural and detection markers, pointing out exact mechanisms in SCADvanceXP that would detect analysed threats. The results show that SCADvanceXP is able to detect a wide range of attacks on industrial networks. SCADvanceXP’s rich functionality is able to provide a high standard of security. However, if a threat is affecting systems not directly connected with industrial networks, SCADvanceXP will not be able to detect it. SCADvanceXP only monitors industrial systems, corporate networks must be protected by a different solution to provide the required level of security. Nonetheless, SCADvanceXP is dedicated to operating within industrial networks and does not have access to regular IT networks. It can be concluded, that SCADvanceXP is a specialist tool providing desired security for industrial networks.

DOI

10.35467/sdq/177655

License type

CC BY (attribution alone)

Open Access Mode

open journal

Open Access Text Version

final published version

Date of Open Access to the publication

in press

Ministry points / journal

100

This website uses cookies to remember the authenticated session of the user. For more information, read about Cookies and Privacy Policy.