Biblio

Intrusion detection systems (IDSs) are widely deployed in the industrial control systems to protect network security. IDSs typically generate a huge number of alerts, which are time-consuming for system operators to process. Most of the alerts are individually insignificant false alarms. However, it is not the best solution to discard these alerts, as they can still provide useful information about network situation. Based on the study of characteristics of alerts in the industrial control systems, we adopt an enhanced method of exponentially weighted moving average (EWMA) control charts to help operators in processing alerts. We classify all detection signatures as regular and irregular according to their frequencies, set multiple control limits to detect anomalies, and monitor regular signatures for network security situational awareness. Extensive experiments have been performed using real-world alert data. Simulation results demonstrate that the proposed enhanced EWMA method can greatly reduce the volume of alerts to be processed while reserving significant abnormal information.

This paper considers the problem of the quickest detection of a change in distribution while taking privacy considerations into account. Our goal is to sanitize the signal to satisfy information privacy requirements while being able to detect a change quickly. We formulate the privacy-aware quickest change detection (QCD) problem by including a privacy constraint to Lorden's minimax formulation. We show that the Generalized Likelihood Ratio (GLR) CuSum achieves asymptotic optimality with a properly designed sanitization channel and formulate the design of this sanitization channel as an optimization problem. For computational tractability, a continuous relaxation for the discrete counting constraint is proposed and the augmented Lagrangian method is applied to obtain locally optimal solutions.