A Real-Time Data Capture Probe for Anomaly Detection in Industrial Cyber-Physical Systems

In recent years, Industrial Cyber-Physical Systems (ICPS) have faced growing cyber-attacks due to the exposure of traditional industrial protocols through the Internet. These protocols, lacking built-in security, place Supervisory Control and Data Acquisition (SCADA) networks at serious risk. To address this, the Italian project Industrial Cyber Shield (ICS) aims to develop an intrusion response system that helps operators implement countermeasures when critical anomalies are detected. A key component of this system is an Anomaly Detection System (ADS) which relies on real-time data probes to capture and analyze SCADA network traffic and physical data. However, current literature lacks thorough evaluations of real-time data capture performance. This paper presents a novel data capture probe for anomaly detection in ICPSs. Implemented in Python, the probe enables real-time analysis of performance metrics. To assess its effectiveness, it is tested within a real SCADA network consisting of a water distribution infrastructure in a controlled laboratory environment.