{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,12]],"date-time":"2024-09-12T18:39:51Z","timestamp":1726166391672},"publisher-location":"Cham","reference-count":51,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783031081460"},{"type":"electronic","value":"9783031081477"}],"license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022]]},"DOI":"10.1007\/978-3-031-08147-7_23","type":"book-chapter","created":{"date-parts":[[2022,6,14]],"date-time":"2022-06-14T16:43:08Z","timestamp":1655224988000},"page":"341-354","update-policy":"http:\/\/dx.doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Why Anomaly-Based Intrusion Detection Systems Have Not Yet\u00a0Conquered the\u00a0Industrial Market?"],"prefix":"10.1007","author":[{"given":"S.","family":"Seng","sequence":"first","affiliation":[]},{"given":"J.","family":"Garcia-Alfaro","sequence":"additional","affiliation":[]},{"given":"Y.","family":"Laarouchi","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2022,6,15]]},"reference":[{"key":"23_CR1","doi-asserted-by":"crossref","unstructured":"Denning, D.: An intrusion detection model. In: Proceedings of the Seventh IEEE Symposium on Security and Privacy, pp. 119\u2013131 (1986)","DOI":"10.1109\/SP.1986.10010"},{"key":"23_CR2","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Stakhanova, N., Ghorbani, A.A.: Toward credible evaluation of anomaly-based intrusion-detection methods. Toward Credible Evaluation of Anomaly-Based Intrusion-Detection Methods, vol. 40, issue 5, pp. 516\u2013524. Institute of Electrical and Electronics Engineers, NY Publisher, New-York (2010)","DOI":"10.1109\/TSMCC.2010.2048428"},{"key":"23_CR3","unstructured":"Conti, M., Donadel, D., Turrin, F.: A Survey on Industrial Control System Testbeds and Datasets for Security Research (2021). arXiv: 2102.05631"},{"key":"23_CR4","doi-asserted-by":"crossref","unstructured":"Bhuyan, M.H., Bhattacharyya, D.K., Kalita, J.K.: Network anomaly detection: methods, systems and tools. IEEE Commun. Surv. Tutor. 16(1), 303\u2013336 (2014). (Conference Name: IEEE Communications Surveys Tutorials)","DOI":"10.1109\/SURV.2013.052213.00046"},{"key":"23_CR5","unstructured":"Snort official web site. Snort - Network Intrusion Detection & Prevention System (2021). https:\/\/www.snort.org\/"},{"key":"23_CR6","unstructured":"Zeek official web site. The Zeek Network Security Monitor (2021). https:\/\/zeek.org\/"},{"key":"23_CR7","unstructured":"Suricata official web site. Suricata (2021). https:\/\/suricata-ids.org\/"},{"key":"23_CR8","unstructured":"ClamavNet official web site. ClamavNet (2021). https:\/\/www.clamav.net\/"},{"key":"23_CR9","doi-asserted-by":"crossref","unstructured":"Hurley, J., Munoz, A., Sezer, S.: ITACA: flexible, scalable network analysis. In: 2012 IEEE International Conference on Communications (ICC), pp. 1069\u20131073 (2012). ISSN: 1938\u20131883","DOI":"10.1109\/ICC.2012.6363995"},{"key":"23_CR10","unstructured":"Pan, S., Morris, T., Adhikari, U.: A specification-based intrusion detection framework for cyber-physical environment in electric power system. Int. J. Network Secur. 17, 174\u2013188, 105124 (2015)"},{"key":"23_CR11","doi-asserted-by":"crossref","unstructured":"Bostani, H., Sheikhan, M.: Hybrid of anomaly-based and specification-based IDS for Internet of Things using unsupervised OPF based on MapReduce approach. Comput. Commun. 98, 52\u201371, 105124 (2017)","DOI":"10.1016\/j.comcom.2016.12.001"},{"key":"23_CR12","doi-asserted-by":"crossref","unstructured":"Korba, A.A., Nafaa, M., Ghanemi, S.: Hybrid intrusion detection framework for Ad hoc networks. Int. J. Inf. Secur. Privacy 10(4), 1\u201332 (2016)","DOI":"10.4018\/IJISP.2016100101"},{"key":"23_CR13","doi-asserted-by":"crossref","unstructured":"Lavin, A., Ahmad, S.: Evaluating real-time anomaly detection algorithms - the numenta anomaly benchmark. In: 2015 IEEE 14th International Conference on Machine Learning and Applications (ICMLA), pp. 38\u201344 (2015)","DOI":"10.1109\/ICMLA.2015.141"},{"key":"23_CR14","doi-asserted-by":"publisher","unstructured":"Hu, J.: Host-based anomaly intrusion detection. In: Stavroulakis, P., Stamp, M., (eds.) Handbook of Information and Communication Security, pp. 235\u2013255. Springer, Heidelberg (2010). https:\/\/doi.org\/10.1007\/978-3-642-04117-4_13","DOI":"10.1007\/978-3-642-04117-4_13"},{"key":"23_CR15","unstructured":"Orans, L., D\u2019Hoinne, J., Chessman, J.: Gartner - Market Guide for Network Detection and Response (2020). https:\/\/www.gartner.com\/doc\/reprints?id=1-1Z8C9OAX&ct=200612&st=sb"},{"key":"23_CR16","unstructured":"Garner-Hype. 2 Megatrends Dominate the Gartner Hype Cycle for Artificial Intelligence (2020)"},{"key":"23_CR17","unstructured":"wikipedia. Comparison of antivirus software (2021). https:\/\/en.wikipedia.org\/w\/index.php?title=Comparison_of_antivirus_software&oldid=1003484641. (Page Version ID: 1003484641)"},{"key":"23_CR18","doi-asserted-by":"crossref","unstructured":"Wainer, J., Barsottini, C.G.N., Lacerda, D., de Marco, L.R.M.: Empirical evaluation in computer science research published by ACM. Inf. Software Technol. 51(6), 1081\u20131085 (2009)","DOI":"10.1016\/j.infsof.2009.01.002"},{"key":"23_CR19","doi-asserted-by":"publisher","unstructured":"Osorio, A., Dias, M., Cavalheiro, G.G.H.: Tangible assets to improve research quality: a meta analysis case study. In: Bianchini, C., Osthoff, C., Souza, P., Ferreira, R. (eds.) WSCAD 2018. CCIS, vol. 1171, pp. 117\u2013132. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-41050-6_8","DOI":"10.1007\/978-3-030-41050-6_8"},{"key":"23_CR20","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., Ghorbani, A.A.: A detailed analysis of the KDD CUP 99 data set. In: 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, pp. 1\u20136 (2009). ISSN: 2329\u20136275","DOI":"10.1109\/CISDA.2009.5356528"},{"issue":"3","key":"23_CR21","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1016\/j.cose.2011.12.012","volume":"31","author":"A Shiravi","year":"2012","unstructured":"Shiravi, A., Shiravi, H., Tavallaee, M., Ghorbani, A.A.: Toward developing a systematic approach to generate benchmark datasets for intrusion detection. Comput. Secur. 31(3), 357\u2013374 (2012)","journal-title":"Comput. Secur."},{"key":"23_CR22","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2019.105124","volume":"189","author":"A Aldweesh","year":"2020","unstructured":"Aldweesh, A., Derhab, A., Emam, A.Z.: Deep learning approaches for anomaly-based intrusion detection systems: a survey, taxonomy, and open issues. Knowl.-Based Syst. 189, 105124 (2020)","journal-title":"Knowl.-Based Syst."},{"key":"23_CR23","unstructured":"Darpa. KDD Cup 1999 Data (1999)"},{"key":"23_CR24","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., Ghorbani, A.A.: Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: Proceedings of the 4th International Conference on Information Systems Security and Privacy, pp. 108\u2013116. SCITEPRESS - Science and Technology Publications, Funchal, Madeira, Portugal (2018)","DOI":"10.5220\/0006639801080116"},{"key":"23_CR25","unstructured":"Singapore University of Technology and Design. Secure Water Treatment (2015). https:\/\/itrust.sutd.edu.sg\/testbeds\/secure-water-treatment-swat\/"},{"key":"23_CR26","doi-asserted-by":"crossref","unstructured":"Brown, C.D., Davis, H.T.: Receiver operating characteristics curves and related decision measures: a tutorial. Chemomet. Intell. Lab. Syst. 80(1), 24\u201338, 105124 (2006)","DOI":"10.1016\/j.chemolab.2005.05.004"},{"key":"23_CR27","doi-asserted-by":"crossref","unstructured":"Szczepa\u0144ski, M., Chora\u015b, M., Pawlicki, M., Kozik, R.: Achieving explainability of intrusion detection system by hybrid oracle-explainer approach. In: 2020 International Joint Conference on Neural Networks (IJCNN), pp. 1\u20138 (2020). ISSN: 2161\u20134407","DOI":"10.1109\/IJCNN48605.2020.9207199"},{"key":"23_CR28","doi-asserted-by":"crossref","unstructured":"Debar, H., Dacier, M., Wespi, A.: A revised taxonomy for intrusion-detection systems. Ann. Des T\u00e9l\u00e9commun. 55(7), 361\u2013378, 105124 (2000)","DOI":"10.1007\/BF02994844"},{"key":"23_CR29","doi-asserted-by":"publisher","unstructured":"Ghorbani, A.A., Lu, W., Tavallaee, M.: Evaluation criteria. In: Ghorbani, A.A., Wei, L., Tavallaee, M. (eds.) Network Intrusion Detection and Prevention. ADIS, vol. 47, pp. 161\u2013183. Springer, US, Boston, MA (2010). https:\/\/doi.org\/10.1007\/978-0-387-88771-5_7","DOI":"10.1007\/978-0-387-88771-5_7"},{"key":"23_CR30","unstructured":"Duval, A.: Explainable Artificial Intelligence (XAI). MA4K9 Scholarly Report, Mathematics Institute, The University of Warwick (2019)"},{"key":"23_CR31","unstructured":"Gunning, D.: Explainable Artificial Intelligence (XAI). Machine learning, p. 18 (2016)"},{"key":"23_CR32","doi-asserted-by":"crossref","unstructured":"Carvalho, D.V., Pereira, E.M., Cardoso, J.S.: Machine learning interpretability: a survey on methods and metrics. Electronics 8(8), 832 (2019). Number: 8 Publisher: Multidisciplinary Digital Publishing Institute","DOI":"10.3390\/electronics8080832"},{"key":"23_CR33","doi-asserted-by":"crossref","unstructured":"Ribeiro, M.T., Singh, S., Guestrin, C.: Why should i trust you?: explaining the predictions of any classifier. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, KDD 2016, pp. 1135\u20131144. Association for Computing Machinery, New York, NY, USA (2016)","DOI":"10.1145\/2939672.2939778"},{"key":"23_CR34","unstructured":"Cheng, H., et al.: Multimedia Event Detection and Recounting, p. 12 (2014)"},{"key":"23_CR35","doi-asserted-by":"crossref","unstructured":"Mitchell, R., Chen, I.-R.: A survey of intrusion detection techniques for cyber-physical systems. ACM Comput. Surv. 46(4), 55:1\u201355:29 (2014)","DOI":"10.1145\/2542049"},{"key":"23_CR36","unstructured":"Cheung, S., Dutertre, B., Fong, M., Lindqvist, U., Skinner, K., Valdes, A.: Using Model-based Intrusion Detection for SCADA Networks (2006)"},{"key":"23_CR37","doi-asserted-by":"crossref","unstructured":"Yu, C., et al.: The implementation of IEC60870-5-104 based on UML statechart and QT state machine framework. In: 2015 IEEE 5th International Conference on Electronics Information and Emergency Communication, pp. 392\u2013397 (2015)","DOI":"10.1109\/ICEIEC.2015.7284566"},{"key":"23_CR38","doi-asserted-by":"crossref","unstructured":"Wickramasinghe, C.S., Marino, D.L., Amarasinghe, K., Manic, M.: Generalization of deep learning for cyber-physical system security: a survey. In: IECON 2018\u201344th Annual Conference of the IEEE Industrial Electronics Society, pp. 745\u2013751 (2018). ISSN: 2577\u20131647","DOI":"10.1109\/IECON.2018.8591773"},{"key":"23_CR39","doi-asserted-by":"crossref","unstructured":"Beyerer, J., Maier, A., Niggemann, O.: Machine Learning for Cyber Physical Systems: Selected papers from the International Conference ML4CPS 2020. Springer (2021). Google-Books-ID: r8kQEAAAQBAJ","DOI":"10.1007\/978-3-662-62746-4"},{"key":"23_CR40","doi-asserted-by":"publisher","unstructured":"Fovino, I.N., Carcano, A., Masera, M., Trombetta, A.: Design and implementation of a secure modbus protocol. In: Palmer, C., Shenoi, S. (eds.) ICCIP 2009. IAICT, vol. 311, pp. 83\u201396. Springer, Heidelberg (2009). https:\/\/doi.org\/10.1007\/978-3-642-04798-5_6","DOI":"10.1007\/978-3-642-04798-5_6"},{"key":"23_CR41","doi-asserted-by":"publisher","unstructured":"Aarts, F., Kuppens, H., Tretmans, J., Vaandrager, F., Verwer, S.: Improving active Mealy machine learning for protocol conformance testing. Mach. Learn. 189\u2013224 (2013). https:\/\/doi.org\/10.1007\/s10994-013-5405-0","DOI":"10.1007\/s10994-013-5405-0"},{"key":"23_CR42","doi-asserted-by":"crossref","unstructured":"Lin, H., Slagell, A., Kalbarczyk, Z., Sauer, P.W., Iyer, R.K.: Semantic security analysis of SCADA networks to detect malicious control commands in power grids. In: Proceedings of the first ACM workshop on Smart Energy Grid Security, SEGS 2013, pp. 29\u201334. Association for Computing Machinery, Berlin, Germany (2013)","DOI":"10.1145\/2516930.2516947"},{"key":"23_CR43","doi-asserted-by":"crossref","unstructured":"Had\u017eiosmanovi\u0107, D., Sommer, R., Zambon, E., Hartel, P.H.: Through the eye of the PLC: semantic security monitoring for industrial processes. In: Proceedings of the 30th Annual Computer Security Applications Conference, ACSAC 2014, pp. 126\u2013135. Association for Computing Machinery, New Orleans, Louisiana, USA (2014)","DOI":"10.1145\/2664243.2664277"},{"key":"23_CR44","unstructured":"Barbosa, R.R.R.: Anomaly detection in SCADA systems: a network based approach (2014)"},{"key":"23_CR45","doi-asserted-by":"crossref","unstructured":"Caselli, M., Zambon, E., Kargl, F.: Sequence-aware Intrusion Detection in Industrial Control Systems. In: Proceedings of the 1st ACM Workshop on Cyber-Physical System Security, CPSS 2015, pp. 13\u201324. Association for Computing Machinery, Singapore, Republic of Singapore (2015. )","DOI":"10.1145\/2732198.2732200"},{"key":"23_CR46","unstructured":"Kerkers, M.: Assessing the Security of IEC 60870-5-104 Implementations using Automata Learning. Library Catalog: essay.utwente.nl Publisher: University of Twente (2017)"},{"key":"23_CR47","doi-asserted-by":"crossref","unstructured":"Udd, R., Asplund, M., Nadjm-Tehrani, S., Kazemtabrizi, M., Ekstedt, M.: Exploiting bro for intrusion detection in a SCADA System. In Proceedings of the 2nd ACM International Workshop on Cyber-Physical System Security, CPSS 2016, pp. 44\u201351. Association for Computing Machinery, Xi'an, China (2016)","DOI":"10.1145\/2899015.2899028"},{"key":"23_CR48","doi-asserted-by":"crossref","unstructured":"Kaouk, M., Flaus, J.-M., Potet, M.-L., Groz, R.: A review of intrusion detection systems for industrial control systems. In 2019 6th International Conference on Control, Decision and Information Technologies (CoDIT), pp. 1699\u20131704 (2019). ISSN: 2576\u20133555","DOI":"10.1109\/CoDIT.2019.8820602"},{"key":"23_CR49","doi-asserted-by":"crossref","unstructured":"Khan, I.A., et al.: Efficient behaviour specification and bidirectional gated recurrent units-based intrusion detection method for industrial control systems. Electron. Lett. 56(1), 27\u201330 (2019). Publisher: IET Digital Library","DOI":"10.1049\/el.2019.3008"},{"key":"23_CR50","doi-asserted-by":"crossref","unstructured":"Olufowobi, H., Young, C., Zambreno, J., Bloom, G.: SAIDuCANT: specification-based automotive intrusion detection using controller area network (CAN) timing. IEEE Trans. Veh. Technol. 69(2), 1484\u20131494 (2020). (Conference Name: IEEE Transactions on Vehicular Technology)","DOI":"10.1109\/TVT.2019.2961344"},{"key":"23_CR51","doi-asserted-by":"crossref","unstructured":"Mitchell, R., Chen, I-R.: Behavior-rule based intrusion detection systems for safety critical smart grid applications. IEEE Trans. Smart Grid 4(3), 1254\u20131263 (2013). (Conference Name: IEEE Transactions on Smart Grid)","DOI":"10.1109\/TSG.2013.2258948"}],"container-title":["Lecture Notes in Computer Science","Foundations and Practice of Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-08147-7_23","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,6,14]],"date-time":"2022-06-14T16:46:05Z","timestamp":1655225165000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-08147-7_23"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"ISBN":["9783031081460","9783031081477"],"references-count":51,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-08147-7_23","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2022]]},"assertion":[{"value":"15 June 2022","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"FPS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Symposium on Foundations and Practice of Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Paris","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"France","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2021","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"7 December 2021","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"10 December 2021","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"14","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"fps2021","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/www.fps-2021.com\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Single-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"62","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"18","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"29% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}