Host-Based Intrusion Detection for Industrial Control Systems

Industrial Control Systems (ICS) are increasingly vulnerable to cyberattacks, particularly those that circumvent standard Network-Based Intrusion Detection Systems (NIDS) and manipulate control logic. The present investigation looks at a unique technique for improving ICS security: effectively incorporating lightweight Host-Based Intrusion Detection Systems (HIDS) into Programmable Logic Controllers (PLCs). This technique provides a more comprehensive and rapid degree of security through monitoring device activity in real time. The methodology uses formal specification methods to generate attributes from industrial control logic and regulations that can be verified at runtime. A simplified runtime monitor is built into the PLC's scanning cycle to ensure it meets real-time operating requirements. The approach is tested on the G-ICS testbed, establishing groundwork for hybrid detection methods that integrate host and network-level alerts for enhanced anomaly detection and system resilience.