SCADvanceXP—an intelligent Polish system for threat detection and monitoring of industrial networks
SCADvanceXP—an intelligent Polish system for threat detection and monitoring of industrial networks

Summary/Abstract: SCADvanceXP is an industrial network intrusion detection system that scans and monitors data exchange between engineeringstations, field divides, controllers, supervisory control and data acquisition (SCADA), and other elements of the operational technologynetwork in detail. SCADvanceXP has the potential to detect advanced attacks on industrial infrastructures with the use of rule-based, signature-based, and behavioural detection methods, which are supported by sophisticated machine and deep learning models.As a system developed in Poland, it addresses the needs of industry in that region of Europe. The goal of this work was to assessSCADvanceXP’s potential to detect common industrial threats. In order to check SCADvanceXP’s potential, an effort was undertakento evaluate its functionality on major industrial threats. For that purpose, twelve malware strains interfering with industrial systemswere described. Later, the SCADvanceXP functionality was overlapped on malware behavioural and detection markers, pointing outexact mechanisms in SCADvanceXP that would detect analysed threats. The results show that SCADvanceXP is able to detect a widerange of attacks on industrial networks. SCADvanceXP’s rich functionality is able to provide a high standard of security. However, if athreat is affecting systems not directly connected with industrial networks, SCADvanceXP will not be able to detect it. SCADvanceXPonly monitors industrial systems; hence, corporate networks must be protected by a different solution to provide the required level of security. Nonetheless, SCADvanceXP is dedicated to operating within industrial networks and does not have access to regular ITnetworks. It can be concluded that SCADvanceXP is a specialist tool providing desired security for industrial networks.

• Details
• Contents