KIDS: intrusion detection for industrial control systems
Loading...
Files
Accepted Version
Date
2025-08-09
Authors
Wani, Nowshaba Jeelani
Pesch, Dirk
Roedig, Utz
Journal Title
Journal ISSN
Volume Title
Publisher
Springer Nature
Published Version
Abstract
The convergence of Information Technology (IT) and Operational Technology (OT) has significantly increased the vulnerability of Industrial Control Systems (ICS). Prolonged undetected intrusions and the frequent exploitation of zero-day vulnerabilities have made ICS highly susceptible to cyberattacks, resulting in data loss and physical damage. Despite growing threats, majority of Intrusion Detection Systems (IDS) ignore the significance of process-based data and equipment such as Programmable Logic Controllers (PLCs) and focus on the management components of ICS, which are essentially an IT system. Many suggested IDS are also only effective with known attacks and fail to detect zero-day exploits. The lack of a unified IDS across IT and OT, applicable irrespective of protocols employed or hardware heterogeneity, is another significant gap in this field. This paper presents Kestrel-Based Intrusion Detection System (KIDS), a query-based, process-aware framework tailored for OT. Built on the Kestrel threat hunting language, KIDS combines process monitoring with traditional threat intelligence to detect sophisticated attacks across all layers of ICS. By abstracting system components and complexities into unified query interfaces, KIDS enables holistic visibility, from management systems to PLCs, and supports scalable, cross-platform threat detection adaptable to evolving industrial threats.
Description
Keywords
Security , Threat hunting , Operational technologies , Intrusion detection systems , Industrial control systems
Citation
Wani, N. J., Pesch, D. and Roedig, U. (2025) 'KIDS: intrusion detection for industrial control systems', in Coppens, B., Volckaert, B., Naessens, V. and De Sutter, B. (eds) Availability, Reliability and Security. ARES 2025. Lecture Notes in Computer Science, 15994, pp 191–208. Springer, Cham. https://doi.org/10.1007/978-3-032-00630-1_11