Cross-domain alert correlation methodology for industrial control systems

Alert correlation is a set of techniques that process alerts raised by intrusion detection systems to eliminate redundant alerts, reduce the number false positives, and reconstruct attack scenarios. Since Industrial Control Systems (ICSs) exhibit both physical cyber domain, they present unique challenges for alert correlation. The presence heterogeneous domains each with its specific threats has led development multi-domain techniques. Indeed, some approaches rely solely on observations at level while other will monitor process. Although these two are complementary, nature information carried differs. In this article, we develop an framework tailored explicitly ICSs. We combine domain more classical alerts. approach maps into using enrichment. also propose selection adapts state dynamically adjusting size selected window. test our realistic experimental setup publicly release all datasets used derive results. Our cross-domain methodology achieves better metrics compared temporal-based in terms rate, missing rate reduction.