Engineering Trustworthy Systems: Get Cybersecurity Design Right the First Time

CHAPTER

14   Detection Systems

Overview

•   14.1 Types of Detection Systems

•   14.1.1 Signature-Based

•   14.1.2 Anomaly Detection

•   14.2 Detection Performance: False Positives, False Negatives, and ROCs

•   14.2.1 Feature Selection

•   14.2.2 Feature Extraction

•   14.2.3 Event Selection

•   14.2.4 Attack Detection

•   14.2.5 Attack Classification

•   14.2.6 Attack Alarming

•   14.3 Drive Detection Requirements from Attacks

•   14.4 Detection Failures

•   14.4.1 Blind Sensors

•   14.4.2 Below Noise Floor

•   14.4.3 Below Alert Threshold

•   14.4.4 Improper Placement

•   14.4.5 Natural Failure

•   14.4.6 Successfully Attacked

•   14.4.7 Blocked Sensor Input

•   14.4.8 Blocked Report Output

Learning Objectives

•   Distinguish and contrast ...