Towards SCADA Threat Intelligence based on Intrusion Detection Systems - A Short Review

Securing and protecting Supervisory Control and Data Acquisition (SCADA) systems have been an active topic of research for the past decades due to the catastrophic and disastrous consequences when these systems are breached or compromised. Therefore, possible cyberattacks and malicious behaviours must be addressed instantly to prevent catastrophic and disastrous consequences on the national critical infrastructures. To this end, intrusion detection systems are considered as an essential security defence mechanism for SCADA networks. It can effectively detect potential cyberattacks and malicious activities and prevent catastrophic consequences. However, zero-day, deception and stealth attacks require a special type of detection methods in which it should be able to identify anomalies and detect possible malicious activities. There are a handful number of studies that have been carried out previously in this regard. However, this area of research is still immature and emerging. Therefore, this research is intended to investigate the merits, limitations and drawbacks of the existing detection methods, investigates the cyberattacks on SCADA systems, identify key features that can be used to discover irregular activities and to put forward the requirements and recommendations for detect cyberattacks and malicious activities in the SCADA networks.