Cyberattack detection

Intrusion detection systems (IDSs) are designed to detect attacks against ICSs, computer systems and networks, etc. IDSs can include software and hardware components and are used to identify an attack by tracking user activities. They can be passive or active. Passive IDSs initiate proper alerts that may help take appropriate actions to limit negative impact of a cyberattack on the CPS, while active IDSs respond to identified cyberattacks by taking corrective actions. This paper focuses on passive IDSs. Unlike the other types of security such as firewalls, control of access or encryption, IDSs detect attackers that have already accessed the system. Hence it is important that IDSs and intrusion prevention be used in tandem to enhance system security.

The performance of IDSs can be evaluated using the following measures (table