Intrusion Detection and Prevention in Industrial Internet of Things: A Study.

The Industrial Internet of Things (IIoT) brings the ubiquitous connectivity of the Internet of Things (IoT) to industrial processes, optimizing manufacturing and civil infrastructures with assorted “smart” technologies. This ubiquitous connectivity to industrial processes has increased the attack surface available to threat actors, with increasingly frequent cyber attacks on physical infrastructure resulting in significant economic and life safety consequences, due to service interruptions in power grids, oil distribution pipelines, etc. The difference between IoT and IIoT is largely one of degree, with the consequence of service interruptions to IoT (ie home automation) typically limited to mild inconvenience, while interruptions to IIoT environments (ie power grids) have more significant economic and life safety consequences. The field of Intrusion Detection Systems / Intrusion Prevention Systems (IDS/IPS) has traditionally focused on cyber components rather than physical components, which has resulted in threat detection capabilities in IIoT environments lagging behind their non-industrial counterparts, leading to increasingly frequent attacks by threat actors against critical infrastructure. This paper reviews the current state of IDS/IPS capabilities in industrial environments and compares the maturity and effectiveness to the more established IDS/IPS capabilities of non-industrial Information Technology (IT) networks. As a new contribution, this paper also identifies gaps in the existing research in the field, and maps selected challenges to potential solutions and/or opportunities for further research.