Using Bro with a Simulation Model to Detect Cyber-Physical Attacks in a Nuclear Reactor

Increasing integration of physical components into digital systems has introduced new attack vectors that traditional intrusion detection systems (IDSs) are incapable of protecting with previously developed methods. Physical components can be targeted to change the behavior of the system without modifying the digital network, leading to unsafe or undesirable system states without causing unusual network activity. Anomaly-based detection methods can be adapted to monitor the system's physical behavior to mitigate these attacks. This paper presents such a method utilizing the Bro IDS with a simulation model of the physical system. The state of the model is compared to the state information of the system being transmitted on the network, allowing attacks to be detected by observing inconsistencies between the model and the system.