Question

A manufacturing company recently recovered from an attack on its ICS devices. It has since reduced the attack surface by isolating the affected components. The company now wants to implement detection capabilities. It is considering a system that is based on machine learning.

Which of the following features would BEST describe the driver to adopt such nascent technology over mainstream commercial IDSs?

A. Trains on normal behavior and identifies deviations therefrom
B. Identifies and triggers upon known bad signatures and behaviors
C. Classifies traffic based on logical protocols and messaging formats
D. Automatically reconfigures ICS devices based on observed behavior

Answer 1

The main driver for adopting a machine learning-based system is its capacity to learn what constitutes normal behavior patterns and alert on deviations, providing improved detection capabilities for complex and dynamic ICS environments.

Step-by-step explanation:

The driver to adopt machine learning-based detection systems for Industrial Control Systems (ICS) over mainstream commercial Intrusion Detection Systems (IDSs) is that it trains on normal behavior and identifies deviations from that behavior. Machine learning algorithms are beneficial in environments where traditional signature-based IDSs may not be sufficient, due to the dynamic nature and complexity of ICS.

Machine learning systems can process and learn from large volumes of data to establish what is considered normal, thereby enabling them to detect anomalous activities that could signify a security incident. Understanding the benefits of machine learning in detection can be informed by studies such as those by Bruno & Abrahão (2012), which showed that increasing cognitive efforts in human-operated security centers could lead to more errors. Machine learning's ability to mitigate the risk of human error and adapt to evolving threats is crucial.