Network Security Analysis Using Behavior History Graph

Industrial control system networks are responsible for the operation of critically important functions of modern societies. In this paper we describe a highly distributable technique with low hardware requirements for mapping the typical network behavior of such stable networks. We propose that this technique is able to detect multiple wide ranging attack scenarios threatening these networks. We then proceed to test the techniques´ hypothesized advantages using a industrial control system network of a real world experimental pilot factory. The results for this technique are promising, with the achievement of predicted 100% detection rate for both real and simulated behavior changes in the testing material.