Efficient Intrusion Detection on Low-Performance Industrial IoT Edge Node Devices

Dominik Merli; Felix Sauer; Georg Sigl; Martin Striegel; Matthias Niedermaier

REVIEW 4 major objections 5 minor 26 references

Efficient Intrusion Detection on Low-Performance Industrial IoT Edge Node Devices

T0 review · 4 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that network-based intrusion detection on low-performance microcontrollers is feasible and potent, because the fixed polling rhythm of industrial traffic gives each edge node a timing fingerprint it can learn and monitor.

desk verdict A credible feasibility demo on low-end MCUs, but the 'potent detection' conclusion is unsupported because no quantitative detection metrics are reported. read the letter →

arxiv 1908.03964 v1 pith:DCPQCPQN submitted 2019-08-11 cs.CR

Matthias Niedermaier , Martin Striegel , Felix Sauer , Dominik Merli , Georg Sigl This is my paper · ORCID

classification cs.CR

keywords intrusiondetectionindustrialIoTmicrocontrollerModbus/TCPinterarrivaltimePLCnetworksecurityembeddedsystems

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that an intrusion detection system can run directly on the low-power microcontrollers used in industrial edge nodes, not only on servers or gateways. It argues that industrial traffic's regular polling rhythm provides a reliable statistical fingerprint, and that a microcontroller can learn that fingerprint, detect deviations, and report them without disrupting the controlled process. The proof is a FreeRTOS/LwIP implementation on an STM32F7 node in a twelve-device Modbus/TCP testbed that detects a range of network attacks while adding only modest latency and throughput overhead. If true, it means decentralized, per-device monitoring is practical for industrial networks.

What carries the argument

The working mechanism is per-connection timing statistics: each flow is reduced to the interarrival time of its packets, the gap in milliseconds between successive packets, which is periodic under PLC polling. During training the agent records these times for each connection and then guards two quantities: the cumulative moving average of interarrival times with a relative tolerance offset $\Delta$ (Equation 1), and the observed minimum and maximum interarrival times expanded by the same offset (Equation 2). A live packet whose timing lies outside those boundaries, or whose source metadata was never learned, triggers an incident. Because the statistics stay small, the detector adds only about 3.3 kB to the binary, allowing it to fit comfortably in the resource budget of a low-end MCU.

What would settle it

Deploy the same IDS on a live production line with realistic timing jitter, non-periodic HMI use, and multiple polling masters, then record how often normal operation is flagged; if false alarms make the alarm unusable, or if an attacker who replays the learned polling pattern at the learned intervals goes undetected, the central feasibility claim is contradicted in that regime.

Watch

Extended reading notes

Core claim

The central claim is that network-based intrusion detection on low-performance microcontrollers is feasible and potent because industrial traffic is dominated by fixed-cycle polling. The approach learns the per-connection periodic behavior during an attack-free training window, stores the moving average of packet interarrival times plus minimum and maximum bounds with an adjustable tolerance, and flags any live packet whose timing or connection metadata falls outside those bounds. In a twelve-device open-source Modbus/TCP testbed, the method detected node removal, ARP sniffing via poisoning, spoofing, packet injection, and flooding attacks, while acknowledging that passive sniffing and attacks inserted during the training window remain undetectable. The implementation added roughly 0.8 ms to ping latency and reduced throughput from 28.2 Mbit/s to 4.23 Mbit/s, still far above the roughly 100 kbit/s the process needs.

Load-bearing premise

The entire detector assumes that benign industrial traffic is periodic enough that learned interarrival-time thresholds separate it from any attack, and that no attacker is present during the learning window.

Editorial extensions

If this is right

An MCU-based detector can be upgraded to an intrusion prevention system by dropping flagged packets inside the LwIP stack before the application sees them, requiring no new hardware.
Because detection uses metadata below the application layer, the method remains protocol-neutral and can be retrofitted to existing industrial networks, including future deployments where application payloads are encrypted.
A practical learning window can be set at roughly twice the longest observed broadcast interval, about ten minutes in the testbed, and the thresholds can then be adjusted slowly during runtime to track minor changes.
Central logging stays reliable even under flooding because each edge node sends a signed, time-stamped keep-alive broadcast every ten seconds; a missing keep-alive is itself an intrusion signal.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: The threshold pair in Equations 1 and 2 assumes a single dominant polling period; networks with several controllers polling the same node at different rates may need per-peer thresholds or an additional periodicity test, which is a natural follow-on experiment.
Editorial inference: The same timing fingerprint could also verify the phase of polled traffic rather than only the interval, which would catch an attacker who replays the learned average rate at the wrong moments.
Editorial inference: If edge nodes share a broadcast domain, their keep-alive messages could act as a mutual heartbeat, letting trusted neighbors flag a captured node that continues sending valid-looking status messages.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

This paper is worth a look if you care about lightweight IDS for industrial edge nodes. The authors build a distributed, timing-based anomaly detector inside LwIP on a Cortex-M7, deploy it in a physical testbed with eight sensors, a PLC, HMI, and SCADA, and measure the cost: ping latency goes from 0.31 ms to 1.13 ms, throughput drops from 28.2 to 4.23 Mbit/s, and the detector adds only 3.3 kB of flash. That is genuine engineering evidence, and it supports the feasibility claim well. The protocol-independent metadata design and the runtime adjustment of thresholds are also practical choices, even if the underlying statistical timing idea is not new (Barbosa, Lin, Haller, and Payer are all cited, and the citation pattern looks fine).

Where the paper falls short is the detection-effectiveness claim. Section 5.3.1 evaluates eight attack scenarios only via Table 2's qualitative symbols: detected, dependent, not detected. No detection rate, false-positive rate, or detection latency is reported anywhere. The conclusion's sentence that 'numerous network-based cyber attacks are detected reliably' is not backed by the measurements. This is a support problem, not an internal inconsistency; Equations (1) and (2) are standard threshold detectors and the concept is coherent. But the testbed is also a best case: all polling is fixed at 100 ms, so the interarrival-time distribution is unusually tight. Real traffic with jitter or maintenance events would likely produce false positives with the min/max test of Eq. (2), and the paper gives no data to assess that. The learning-phase assumption of an untainted network is acknowledged in Section 3.4, and the 'dependent' marks for learning and capture attacks are honest, but they should temper the conclusion's confidence.

Who this is for: embedded systems people building practical ICS defenses, and researchers working on timing-based anomaly detection. The testbed and implementation details are useful; the evaluation methodology is not. I would send it to peer review because the system work is real and reproducible, but a serious referee should require quantitative detection experiments, including false positives on non-ideal traffic, before the 'potent' claim is accepted.

Referee Report

4 major / 5 minor

Summary. The paper proposes a distributed, network-based intrusion detection system for industrial IoT edge nodes, designed to run on low-performance microcontrollers. The system learns per-connection timing statistics during a training phase and then flags deviations using a moving-average comparison (Eq. 1) and a min/max interarrival-time test (Eq. 2). The authors implement the IDS inside the LwIP stack on an STM32F7 MCU running FreeRTOS, integrate it with Modbus/TCP in an open-source testbed, and report resource overhead (ping, throughput, memory). The paper concludes that network-based IDSs on low-performance MCUs are a feasible and potent way of detecting intrusions in industrial networks. The attack evaluation in Table 2, however, is qualitative only, with no numerical detection rates, false-positive rates, or detection latencies reported.

Significance. If the central claim is supported, the contribution is significant: a lightweight, protocol-independent IDS that can run directly on commodity MCUs would enable distributed network defense for industrial networks without dedicated monitoring hardware. The paper provides a concrete proof-of-concept implementation, measurements of timing and memory overhead, and an open-source testbed, which are useful strengths. The main caveat is that the 'potent' part of the claim is not yet demonstrated, because the detection effectiveness of the proposed statistics is never quantitatively evaluated.

major comments (4)

[Section 5.3.1, Table 2] Table 2 reports only qualitative symbols for eight attack scenarios (detected, dependent, not detected). No detection rate, false-positive rate, or detection latency is given for any scenario. The conclusion's statement that 'numerous network-based cyber attacks are detected reliably' is therefore not supported by the presented measurements. Please add per-scenario quantitative metrics, such as true-positive rate, false-positive rate, or at least the number of test repetitions and misses, together with time-to-detection.
[Section 3.2.2, Equations (1) and (2)] The method's central assumption is that learned interarrival-time min/max and moving averages separate normal from intrusive traffic. The paper does not report the observed distribution spread, the chosen values of the tolerance offset delta, or any sensitivity analysis. Since Eq. (2) triggers on any packet outside the learned bounds, jitter, maintenance traffic, or non-periodic events in a real industrial deployment will likely cause false positives; please quantify this risk with data or a robustness experiment.
[Section 5.3.2] The learning-time rule, stated as approximately two times the longest ARP interarrival time, is asserted without supporting measurement or justification. This is load-bearing because the training phase determines the baseline thresholds for both equations. Please show data on how detection performance and false-positive behavior vary with learning time, or provide a principled argument for the stated rule.
[Sections 5.1 and 5.2] The testbed uses deterministic 100 ms polling from the PLC, HMI, and SCADA systems for all Modbus/TCP traffic. This is a best-case scenario for timing-based detection. The paper should discuss how the method degrades under jitter, less regular traffic, or multiple pollers, and ideally include an experiment with artificially introduced timing variation to bound the expected false-positive rate.

minor comments (5)

[Table 1] The software column lists 'FreeRRTOS' for the sensors and actuator; this should be 'FreeRTOS'.
[Section 3.2.2, after Eq. (1)] The sentence 'The interarrival time during learning istl' is a typo and should read 'is t_l'; also, the subscript formatting in the equations should be cleaned up for readability.
[Table 3] The header 'with IDS and whithout IDS' contains a typo; 'whithout' should be 'without'.
[Section 6] The sentence 'The measurements conducted, that numerous network-based cyber attacks are detected reliably' is grammatically incomplete; it should be rephrased, for example as 'The measurements show that numerous network-based cyber attacks are detected reliably.'
[Section 5.3.1] The enumerated attack descriptions use superscript-like numbers after verbs (e.g., 'removes 1 an edge node'), which appears to be a formatting artifact; please use consistent enumeration or bullets.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the timing-threshold detector is an anomaly detector whose outputs follow from its learned baseline by design, and the self-citations are not load-bearing.

full rationale

The paper's central derivation is a standard anomaly-detection setup: Equations (1) and (2) define moving-average and min/max thresholds from interarrival times observed during an untainted learning phase, and the system then flags current traffic falling outside those thresholds. This is the intended detection function, not a prediction that is secretly fitted to the same data it claims to predict. The conclusion that network-based attacks are 'detected reliably' is weakened by the absence of quantitative detection metrics (TPR/FPR, latency) in Section 5.3, but this is an evidentiary gap, not circularity. The self-citations ([19], [20], [23]) provide background on PLC vulnerabilities, testbed design, and field troubleshooting; none of them is load-bearing for the proposed IDS algorithm or its evaluation. No uniqueness theorem is imported from the authors' prior work, no ansatz is smuggled in via citation, and no known result is merely renamed. The paper's own limitations section explicitly acknowledges that an attack during the learning phase would be learned as normal, which confirms the model's assumptions rather than hiding them. Therefore, no circular step meeting the required evidentiary standard can be exhibited.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim rests on domain assumptions about periodic industrial traffic and an untainted training phase, plus several user-set parameters (delta, learning time, keep-alive timing) whose values are not systematically justified. No new theoretical entities are introduced.

free parameters (4)

Tolerance offset delta
Used in Equations 1 and 2 to widen the learned bounds; no value or sensitivity analysis is given, so the false-positive/false-negative trade-off is uncharacterized.
Learning time = approximately 10 minutes (2x longest interarrival time)
Chosen heuristically in Section 5.3.2 as twice the longest ARP interarrival time; affects baseline completeness.
Keep-alive interval and timeout = 10 s / 20 s
Arbitrary constants for the liveness detection channel, Section 4.3.
Moving average window size
The number of samples n and nl in Equations 1 and 2 is not specified, so the averaging window is undefined.

assumptions (4)

domain assumption ICS network traffic is periodic (Section 3.2.2).
The entire detection mechanism exploits periodic polling; non-periodic or highly jittered networks are outside the method's validity.
domain assumption The learning phase is free of attackers (Section 3.4).
The baseline is trusted; an attacker present during training becomes part of the learned 'normal' behavior.
domain assumption Metadata below the application layer is sufficient to detect intrusions (Section 3.2.1).
The method ignores payload content, so attacks that preserve addresses, ports, and timing are invisible by construction.
domain assumption The open testbed represents real industrial networks (Section 5.1).
Generalization from 100 ms Modbus/TCP polling to other industrial setups is assumed, not demonstrated.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Efficient Intrusion Detection on Low-Performance Industrial IoT Edge Node Devices." pith.science (2026). https://pith.science/paper/DCPQCPQN

@misc{pith2026190803964,
  author       = {Pith},
  title        = {Pith review of: Efficient Intrusion Detection on Low-Performance Industrial IoT Edge Node Devices},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DCPQCPQN}},
  note         = {Machine review of arXiv:1908.03964}
}

read the original abstract

Communication between sensors, actors and Programmable Logic Controllers (PLCs) in industrial systems moves from two-wire field buses to IP-based protocols such as Modbus/TCP. This increases the attack surface because the IP-based network is often reachable from everywhere within the company. Thus, centralized defenses, e.g. at the perimeter of the network do not offer sufficient protection. Rather, decentralized defenses, where each part of the network protects itself, are needed. Network Intrusion Detection Systems (IDSs) monitor the network and report suspicious activity. They usually run on a single host and are not able to capture all events in the network and they are associated with a great integration effort. To bridge this gap, we introduce a method for intrusion detection that combines distributed agents on Industrial Internet of Things (IIoT) edge devices with a centralized logging. In contrast to existing IDSs, the distributed approach is suitable for industrial low performance microcontrollers. We demonstrate a Proof of Concept (PoC) implementation on a MCU running FreeRTOS with LwIP and show the feasibility of our approach in an IIoT application.

Figures

Figures reproduced from arXiv: 1908.03964 by the authors.

**Figure 2.** Distributed data collection approach. Preliminary data processing is conducted at the edge devices. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** Used information from the stack for intrusion detection. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (11 more)

**Figure 4.** Figure 4: Timing in sensor networks with polling, separated in periodic and irregular timings. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

**Figure 5.** Figure 5: Picture of the baseboard and the custom PCB of the used edge node device. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

**Figure 6.** Figure 6: Overview of the system with integration of the IDS into LwIP. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

**Figure 7.** Figure 7: Current state of the IDS on the edge node display. [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]

**Figure 8.** Figure 8: Network system view on a ”standard” industrial network mapped to our PoC test-bed implementation. Eight [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]

**Figure 9.** Figure 9: Pictures of the open source ICS test-bed, which is controlling a physical process. [PITH_FULL_IMAGE:figures/full_fig_p010_9.png]

**Figure 10.** Figure 10: Webpage running on each edge node, displaying the current IDS status and debug output. [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]

**Figure 11.** Figure 11: Interarrival time of modbus packets. Assessing ARP request interarrival time [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]

**Figure 12.** Figure 12: Interarrival time of ARP request packets. [PITH_FULL_IMAGE:figures/full_fig_p012_12.png]

**Figure 13.** Figure 13: KDE of the interarrival time of Modbus/TCP packets. [PITH_FULL_IMAGE:figures/full_fig_p013_13.png]

**Figure 14.** Figure 14: Measurement of the ping behavior with and without the IDS [PITH_FULL_IMAGE:figures/full_fig_p014_14.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

26 extracted references · 26 canonical work pages

[1]

Openplc: An open source alternative to automation

Thiago Rodrigues Alves, Mario Buratto, Flavio Mauricio de Souza, and Thelma Virginia Rodrigues. Openplc: An open source alternative to automation. In IEEE Global Humanitarian Technology Conference (GHTC 2014), pages 585–589. IEEE, 2014

work page 2014
[2]

Anomaly Detection in SCADA Systems: A Network Based Approach

Rafael Ramos Regis Barbosa. Anomaly Detection in SCADA Systems: A Network Based Approach. 2014

work page 2014
[3]

Exploiting Siemens Simatic S7 PLCs

Dillon Beresford. Exploiting Siemens Simatic S7 PLCs. Black Hat USA, 16(2):723–733, 2011

work page 2011
[4]

A Survey of Intrusion Detection Systems in Wireless Sensor Networks

Ismail Butun, Salvatore D Morgera, and Ravi Sankar. A Survey of Intrusion Detection Systems in Wireless Sensor Networks. IEEE Communications Surveys & Tutorials, 16(1):266–282, 2014

work page 2014
[5]

Research Challenges for the Security of Control Sys- tems

Alvaro A C ´ardenas, Saurabh Amin, and Shankar Sastry. Research Challenges for the Security of Control Sys- tems. In HotSec, 2008

work page 2008
[6]

Design and Implementation of the lwIP TCP/IP Stack

Adam Dunkels. Design and Implementation of the lwIP TCP/IP Stack. Swedish Institute of Computer Science, 2:77, 2001

work page 2001
[7]

A Search Engine Backed by Internet-wide Scanning

Zakir Durumeric, David Adrian, Ariana Mirian, Michael Bailey, and J Alex Halderman. A Search Engine Backed by Internet-wide Scanning. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. ACM, 2015

work page 2015
[8]

Edge-centric Computing: Vision and Challenges

Pedro Garcia Lopez, Alberto Montresor, Dick Epema, Anwitaman Datta, Teruo Higashino, Adriana Iamnitchi, Marinho Barcellos, Pascal Felber, and Etienne Riviere. Edge-centric Computing: Vision and Challenges. ACM SIGCOMM Computer Communication Review, 45(5):37–42, 2015

work page 2015

Show all 26 references

[9]

Accurate Modeling of Modbus/TCP for Intrusion Detection in SCADA Systems

Niv Goldenberg and Avishai Wool. Accurate Modeling of Modbus/TCP for Intrusion Detection in SCADA Systems. International Journal of Critical Infrastructure Protection, 6(2):63–75, 2013

2013
[10]

Networked Control System: Overview and Research Trends

Rachana Ashok Gupta and Mo-Yuen Chow. Networked Control System: Overview and Research Trends. IEEE transactions on industrial electronics, 57(7):2527–2535, 2010

2010
[11]

Engineering Edge Security in Industrial Control Systems

Piroska Haller, B ´ela Genge, and Adrian-Vasile Duka. Engineering Edge Security in Industrial Control Systems. In Critical Infrastructure Security and Resilience, pages 185–200. Springer, 2019

2019
[12]

Attack Taxonomies for the Modbus Proto- cols

Peter Huitsing, Rodrigo Chandia, Mauricio Papa, and Sujeet Shenoi. Attack Taxonomies for the Modbus Proto- cols. International Journal of Critical Infrastructure Protection, 1:37–44, 2008

2008
[13]

Security Issues in SCADA Networks

Vinay M Igure, Sean A Laughter, and Ronald D Williams. Security Issues in SCADA Networks. computers & security, 25(7):498–506, 2006. 15 Efﬁcient Intrusion Detection on Low-Performance Industrial IoT Edge Node Devices A PREPRINT

2006
[14]

C. Jin, S. Valizadeh, and M. van Dijk. Snapshotter: Lightweight intrusion detection and prevention system for industrial control systems. In 2018 IEEE Industrial Cyber-Physical Systems (ICPS), pages 824–829, May 2018

2018
[15]

Timing-based Anomaly Detection in SCADA Net- works

Chih-Yuan Lin, Simin Nadjm-Tehrani, and Mikael Asplund. Timing-based Anomaly Detection in SCADA Net- works
[16]

Physical intrusion detection for industrial control system

Pengfei Liu and Ting Liu. Physical intrusion detection for industrial control system. In 2018 IEEE Conference on Communications and Network Security, CNS 2018, Beijing, China, May 30 - June 1, 2018, pages 1–2, 2018

2018
[17]

Shodan search engine

John Matherly. Shodan search engine. Available at [Online]: https://www.shodan.io, 2009

2009
[18]

An Internet-wide View of ICS Devices

Ariana Mirian, Zane Ma, David Adrian, Matthew Tischer, Thasphon Chuenchujit, Tim Yardley, Robin Berthier, Joshua Mason, Zakir Durumeric, J Alex Halderman, et al. An Internet-wide View of ICS Devices. In 2016 14th Annual Conference on Privacy, Security and Trust (PST), pages 96...

2016
[19]

You Snooze, You Lose: Measuring PLC Cycle Times under Attacks

Matthias Niedermaier, Jan-Ole Malchow, Florian Fischer, Daniel Marzin, Dominik Merli, V olker Roth, and Alexander V on Bodisco. You Snooze, You Lose: Measuring PLC Cycle Times under Attacks. In 12th USENIX Workshop on Offensive Technologies WOOT 18, 2018

2018
[20]

Cort: A communication robustness testbed for industrial control system components

Matthias Niedermaier, Dominik Merli, and Alexander V on Bodisco. Cort: A communication robustness testbed for industrial control system components. In 2018 Fourth International Conference on Event-based Control, Communication, and Signal Processing (EBCCSP), 2018

2018
[21]

U. Payer. State-driven Stack-based Network Intrusion Detection System. In Proceedings of the 7th International Conference on Telecommunications, 2003. ConTEL 2003., volume 2, pages 613–618 vol.2, June 2003

2003
[22]

Locasto, Sergey Bratus, and Sean W

Jason Reeves, Ashwin Ramaswamy, Michael E. Locasto, Sergey Bratus, and Sean W. Smith. Intrusion detection for resource-constrained embedded control systems in the power grid. IJCIP, 5(2):74–83, 2012

2012
[23]

EyeSec: A Retroﬁttable Augmented Reality Tool for Troubleshooting Wireless Sensor Networks in the Field

Martin Striegel, Carsten Rolfes, Fabian Helfert, Max Hornung, Johann Heyszl, and Georg Sigl. EyeSec: A Retroﬁttable Augmented Reality Tool for Troubleshooting Wireless Sensor Networks in the Field. InProceedings of the 2019 International Conference on Embedded Wireless Systems...

2019
[24]

Open Modbus/TCP Speciﬁcation

Andy Swales et al. Open Modbus/TCP Speciﬁcation. Schneider Electric, 29, 1999

1999
[25]

SCADA-speciﬁc Intrusion/Detection Prevention Systems: A Survey and Tax- onomy

Bonnie Zhu and Shankar Sastry. SCADA-speciﬁc Intrusion/Detection Prevention Systems: A Survey and Tax- onomy. In Proceedings of the 1st Workshop on Secure Control Systems (SCS), volume 11, 2010

2010
[26]

Intrusion Detection for CPS Real- time Controllers

Christopher Zimmer, Balasubramany Bhat, Frank Mueller, and Sibin Mohan. Intrusion Detection for CPS Real- time Controllers. In Cyber physical systems approach to smart electric power grid , pages 329–358. Springer, 2015. 16

2015

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

Openplc: An open source alternative to automation

Thiago Rodrigues Alves, Mario Buratto, Flavio Mauricio de Souza, and Thelma Virginia Rodrigues. Openplc: An open source alternative to automation. In IEEE Global Humanitarian Technology Conference (GHTC 2014), pages 585–589. IEEE, 2014

work page 2014

[2] [2]

Anomaly Detection in SCADA Systems: A Network Based Approach

Rafael Ramos Regis Barbosa. Anomaly Detection in SCADA Systems: A Network Based Approach. 2014

work page 2014

[3] [3]

Exploiting Siemens Simatic S7 PLCs

Dillon Beresford. Exploiting Siemens Simatic S7 PLCs. Black Hat USA, 16(2):723–733, 2011

work page 2011

[4] [4]

A Survey of Intrusion Detection Systems in Wireless Sensor Networks

Ismail Butun, Salvatore D Morgera, and Ravi Sankar. A Survey of Intrusion Detection Systems in Wireless Sensor Networks. IEEE Communications Surveys & Tutorials, 16(1):266–282, 2014

work page 2014

[5] [5]

Research Challenges for the Security of Control Sys- tems

Alvaro A C ´ardenas, Saurabh Amin, and Shankar Sastry. Research Challenges for the Security of Control Sys- tems. In HotSec, 2008

work page 2008

[6] [6]

Design and Implementation of the lwIP TCP/IP Stack

Adam Dunkels. Design and Implementation of the lwIP TCP/IP Stack. Swedish Institute of Computer Science, 2:77, 2001

work page 2001

[7] [7]

A Search Engine Backed by Internet-wide Scanning

Zakir Durumeric, David Adrian, Ariana Mirian, Michael Bailey, and J Alex Halderman. A Search Engine Backed by Internet-wide Scanning. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. ACM, 2015

work page 2015

[8] [8]

Edge-centric Computing: Vision and Challenges

Pedro Garcia Lopez, Alberto Montresor, Dick Epema, Anwitaman Datta, Teruo Higashino, Adriana Iamnitchi, Marinho Barcellos, Pascal Felber, and Etienne Riviere. Edge-centric Computing: Vision and Challenges. ACM SIGCOMM Computer Communication Review, 45(5):37–42, 2015

work page 2015