The growing number of attacks against cyber-physical systems (CPSs) in recent years elevates the concern for cybersecurity of industrial control systems (ICSs). The current efforts of ICS cybersecurity are mainly based on firewalls, data diodes and other methods of intrusion prevention, which may not be sufficient for growing cyber threats from motivated attackers. To enhance the cybersecurity of ICS, a cyber-attack detection system built on the concept of defense-in-depth is developed utilizing network traffic data, host system data, and measured process parameters. This attack detection system provides multiple-layer defense in order to gain the defenders precious time before unrecoverable consequences occur in the physical system. The data used for demonstrating the proposed detection system are from a real-time ICS testbed. Five attacks, including man in the middle (MITM), denial of service (DoS), data exfiltration, data tampering, and false data injection, are carried out to simulate the consequences of cyber-attack and generate data for building data-driven detection models. Four classical classification models based on network data and host system data are studied, including k-nearest neighbor (KNN), decision tree, bootstrap aggregating (Bagging), and random forest, to provide a secondary line of defense of cyber-attack detection in the event that the intrusion prevention layer fails. Intrusion detection results suggest that KNN, Bagging, and random forest have low missed alarm and false alarm rates for MITM and DoS attacks, providing accurate and reliable detection of these cyber-attacks. Cyber-attacks that may not be detectable by monitoring network and host system data, such as command tampering and false data injection attacks by an insider, are monitored for by traditional process monitoring protocols. In the proposed detection system, an auto-associative kernel regression (AAKR) model is studied to strengthen early attack detection. The result shows that this approach detects physically-impactful cyber-attacks before significant consequences occur. The proposed multiple-layer datadriven cyber-attack detection system utilizing network, system, and process data is a promising solution for safeguarding an ICS.

The complexity and throughput of computer networks are rapidly increasing as a result of the proliferation of interconnected devices, data-driven applications, and remote working. Providing situational awareness for computer networks requires monitoring and analysis of network data to understand normal activity and identify abnormal activity. A scalable platform to process and visualize data in real time for large-scale networks enables security analysts and researchers to not only monitor and study network flow data but also experiment and develop novel analytics. In this paper, we introduce InSight2, an open-source platform for manipulating both streaming and archived network flow data in real time that aims to address the issues of existing solutions such as scalability, extendability, and flexibility. Case-studies are provided that demonstrate applications in monitoring network activity, identifying network attacks and compromised hosts and anomaly detection.

Endpoint Detection and Response (EDR) systems play a crucial role in continuously monitoring endpoint activities to detect, analyze, and respond to cybersecurity threats in real time. Traditional agent-based EDR systems rely on software agents installed on endpoints for data collection, which can be impractical due to the large number of devices, their mobility, and privacy concerns. In contrast, agentless EDR systems aim to overcome these limitations by remotely collecting network and host data, but they face challenges in precise data attribution because of the transient nature of network addresses. Achieving a fully zero-configuration agentless EDR system remains a significant challenge. This paper introduces InMesh, an innovative system that can identify and monitor endpoints without relying on network addressing or software agents. The effectiveness of the approach is demonstrated using real-world data.

Cybersecurity researchers and security analysts rely heavily on data to train and test network threat detection models, and to conduct post-breach forensic analyses. Comprehensive data-including network traces, host telemetry, and contextual information-are crucial for these tasks. However, widely used public datasets often suffer from outdated network traffic and features, statistical anomalies, and simulation artifacts. Furthermore, existing data collection systems frequently face architectural and computational limitations, necessitating workarounds that result in incomplete or disconnected data. Currently, no framework provides comprehensive data collection from all network segments without requiring specialized or proprietary hardware or software agents. This paper introduces InDepth, a scalable system employing a distributed, data-link layer architecture that enables comprehensive data acquisition across entire networks. We also present a model cyber range capable of dynamically generating datasets for evaluation. We demonstrate the effectiveness of InDepth using real-world network data.