KIDS: intrusion detection for industrial control systems

Simple item page
dc.contributor.authorWani, Nowshaba Jeelanien
dc.contributor.authorPesch, Dirken
dc.contributor.authorRoedig, Utzen
dc.contributor.editorCoppens, Barten
dc.contributor.editorVolckaert, Brunoen
dc.contributor.editorNaessens, Vincenten
dc.contributor.editorDe Sutter, Bjornen
dc.contributor.funderResearch Irelanden
dc.date.accessioned2025-09-10T08:49:20Z
dc.date.available2025-09-10T08:49:20Z
dc.date.issued2025-08-09en
dc.description.abstractThe convergence of Information Technology (IT) and Operational Technology (OT) has significantly increased the vulnerability of Industrial Control Systems (ICS). Prolonged undetected intrusions and the frequent exploitation of zero-day vulnerabilities have made ICS highly susceptible to cyberattacks, resulting in data loss and physical damage. Despite growing threats, majority of Intrusion Detection Systems (IDS) ignore the significance of process-based data and equipment such as Programmable Logic Controllers (PLCs) and focus on the management components of ICS, which are essentially an IT system. Many suggested IDS are also only effective with known attacks and fail to detect zero-day exploits. The lack of a unified IDS across IT and OT, applicable irrespective of protocols employed or hardware heterogeneity, is another significant gap in this field. This paper presents Kestrel-Based Intrusion Detection System (KIDS), a query-based, process-aware framework tailored for OT. Built on the Kestrel threat hunting language, KIDS combines process monitoring with traditional threat intelligence to detect sophisticated attacks across all layers of ICS. By abstracting system components and complexities into unified query interfaces, KIDS enables holistic visibility, from management systems to PLCs, and supports scalable, cross-platform threat detection adaptable to evolving industrial threats.en
dc.description.statusPeer revieweden
dc.description.versionAccepted Versionen
dc.format.mimetypeapplication/pdfen
dc.identifier.citationWani, N. J., Pesch, D. and Roedig, U. (2025) 'KIDS: intrusion detection for industrial control systems', in Coppens, B., Volckaert, B., Naessens, V. and De Sutter, B. (eds) Availability, Reliability and Security. ARES 2025. Lecture Notes in Computer Science, 15994, pp 191–208. Springer, Cham. https://doi.org/10.1007/978-3-032-00630-1_11en
dc.identifier.doi10.1007/978-3-032-00630-1_11en
dc.identifier.endpage208en
dc.identifier.isbn9783032006295en
dc.identifier.isbn9783032006301en
dc.identifier.issn0302-9743en
dc.identifier.issn1611-3349en
dc.identifier.journaltitleLecture Notes in Computer Scienceen
dc.identifier.startpage191en
dc.identifier.urihttps://hdl.handle.net/10468/17854
dc.identifier.volume15994en
dc.language.isoenen
dc.publisherSpringer Natureen
dc.relation.ispartofLecture Notes in Computer Scienceen
dc.relation.ispartofAvailability, Reliability and Securityen
dc.relation.projectinfo:eu-repo/grantAgreement/SFI/Centres for Research Training (CRT) Programme/18/CRT/6222/IE/SFI Centre for Research Training in Advanced Networks for Sustainable Societies/en
dc.rights© 2025, the Author(s), under exclusive license to Springer Nature Switzerland AG. This publication has emanated from research conducted with the financial support of Taighde Éireann – Research Ireland under Grant number 18/CRT/6222. For the purpose of Open Access, the author has applied a CC BY public copyright licence to any Author Accepted Manuscript version arising from this submission.en
dc.rights.urihttps://creativecommons.org/licenses/by/4.0/en
dc.subjectSecurityen
dc.subjectThreat huntingen
dc.subjectOperational technologiesen
dc.subjectIntrusion detection systemsen
dc.subjectIndustrial control systemsen
dc.titleKIDS: intrusion detection for industrial control systemsen
dc.typeConference itemen
dc.typebook-chapteren
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
ARES-ICSCSR2025.pdf
Size:
1.22 MB
Format:
Adobe Portable Document Format
Description:
Accepted Version
Download
License bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
license.txt
Size:
2.71 KB
Format:
Item-specific license agreed upon to submission
Description:
Download
Collections
Computer Science - Conference Items