First Licentiate defence

Industrial control systems (ICS) are used to manage essential infrastructure such as power grids, water treatment plants, and transportation systems. These systems are critical in ensuring that our daily lives run smoothly and efficiently. However, with the increased use of ICS, cybersecurity has become a major concern. If attackers gain access to these systems, they can cause severe damage to equipment or infrastructure, harm the environment, and even risk people’s lives. It’s crucial to prioritize the security of ICS to prevent these potentially devastating consequences.

One of the challenges of securing ICS is that many ICS are built on legacy systems. These old systems were not designed with cybersecurity in mind, making them vulnerable to modern cyber threats. They often lack the necessary security features and protocols required to protect against such threats. As a result, it can be challenging to retrofit these systems with adequate security measures without disrupting their operations.

One way to protect ICSs against cyberattacks is by using advanced intrusion detection techniques that rely on machine learning algorithms. These algorithms continuously monitor the system’s networks, hosts, and physical processes to identify abnormal patterns that could indicate a cyberattack. By detecting such anomalies early, the algorithms can prevent significant damage from occurring. In this thesis, we explore how well different types of machine learning algorithms can be used to create effective intrusion detection systems. Additionally, we investigate to what extent the algorithms can distinguish different attack types.

However, testing intrusion detection methods on actual operating ICS can be dangerous and difficult. Therefore, researchers need controlled testbeds to test their methods. To this end, we introduce a framework for creating virtual testbeds that simulate real-world operational ICSs. This framework enables researchers to simulate various attack scenarios and study the effectiveness of different intrusion detection methods under different customized conditions. Moreover, we propose a set of simulated cyberattacks that can occur on ICSs. We use these attacks to validate and test different intrusion detection algorithms, as well as compare their performance.