Industrial Network Security

Chapter 8. Exception, Anomaly, and Threat Detection

Information in this Chapter:

• Exception Reporting

• Behavioral Anomaly Detection

• Behavioral Whitelisting

• Threat Detection

By defining enclaves, clear policies about what is allowed and what is not have already been obtained. In addition, the operation of each enclave should be well defined and relatively predictable. This supports two important types of behavioral analysis: exception reporting and anomaly detection.

Exception Reporting refers to an automated system that notifies the security administrator whenever a defined policy has been violated. In the context of enclave-based security, this means a notification that the defined enclave has been violated: some user, system, or service is interacting ...