Jakapan Suaboot

Adil Fahad

Zahir Tari

John Grundy

Abdun Naser Mahmood

Albert Y Zomaya

Khalil Drira

A Taxonomy of Supervised Learning for IDSs in SCADA Environments

Keywords: SCADA security, network intrusion, machine learning, supervised learning

Supervisory Control and Data Acquisition (SCADA) systems play an important role in monitoring industrial processes such as electric power distribution, transport systems, water distribution, and wastewater collec-tion systems. Such systems require a particular attention with regards to security aspects, as they deal with critical infrastructures that are crucial to organizations and countries. Protecting SCADA systems from intru-sion is a very challenging task because they do not only inherit traditional IT security threats but they also include additional vulnerabilities related to field components (e.g., cyber-physical attacks). Many of the exist-ing intrusion detection techniques rely on supervised learning that consists of algorithms that are first trained with reference inputs to learn specific information, and then tested on unseen inputs for classification pur-poses. This article surveys supervised learning from a specific security angle, namely SCADA-based intrusion detection. Based on a systematic review process, existing literature is categorized and evaluated according to SCADA-specific requirements. Additionally, this survey reports on well-known SCADA datasets and testbeds used with machine learning methods. Finally, we present key challenges and our recommendations for using specific supervised methods for SCADA systems.

INTRODUCTION

Supervisory Control and Data Acquisition (SCADA) systems have been integrated into our critical infrastructures such as electric power generation, transport systems, water distribution and wastewater collection systems to control and monitor such industrial processes. Since industrial manufacturing and power distribution sites are geographically distant and involve potentially extreme hazards, the integration of SCADA allows operators to maximize cost-effective operations and safety of their personnel [START_REF] Stuart | SCADA: Supervisory Control and Data Acquisition[END_REF]. For example, using a Smart Grid application with SCADA technology, power outages can be quickly diagnosed and temporarily fixed remotely and securely from the control center.

A typical SCADA system is operated through a control center, consisting of a complex of computers, networks, and databases. The databases store values gathered by Master Terminal Unit (MTU) from sensors, e.g., voltage, current, valve pressure, and so on. The control center sends control commands to actuators, such as Programmable Logic Controller (PLC), Remote Terminal Unit (RTU) or Intelligent Electronic Device (IED), to control the industrial processes [START_REF] Stuart | SCADA: Supervisory Control and Data Acquisition[END_REF]. A SCADA system is pervasive, and its components are interconnected using both wireless and wired communication. On the one hand, SCADA is connected to traditional IT and networking technologies (e.g., operating systems and Internet protocols). On the other hand, it is also connected to SCADA-specific technologies, such as industrial devices and communication protocols such as standard protocols (e.g., IEC 60870-5-101 or 104, and DNP3) and proprietary protocols (i.e., Modbus RTU, RP-570, Profibus and Conitel) [START_REF] Vinay | Security issues in SCADA networks[END_REF]. However, any disruption to SCADA systems can result in significant financial loss or even lead to loss of life. In the past, such systems were secure by virtue of their isolation from corporate networks and the Internet, and due to the use of proprietary hardware and software. In other words, they were self-contained and totally isolated from the public networks. This isolation created the myth that malicious intrusions and attacks from the outside world were not a big concern, and such attacks were expected to only come from the inside. Therefore, when developing SCADA protocols, the security of the information systems and the significance of loss due to denial of service was given little consideration.

In recent years, SCADA systems have begun to shift away from using proprietary and customized hardware and software in favor of using Commercial-Off-The-Shelf (COTS) solutions [START_REF] Nicholson | An initial investigation into attribution in SCADA systems[END_REF]. Among the well-known vendors are ABB, Siemens, General Electric (GE), Alstom, SEL, Toshiba, and Schneider Electric [START_REF] Zeynal | Intelligent substation automation systems for robust operation of smart grids[END_REF]. This shift has increased their connectivity to public networks (Internet) using standard protocols, e.g., TCP/IP. In addition, there is a decreased reliance on one vendor. Undoubtedly, this increases productivity and profitability by reducing capital expenditure (Capex). However, this also now exposes such systems to more diverse, intelligent cyber attacks [START_REF] Oman | Concerns about intrusions into remotely accessible substation controllers and SCADA systems[END_REF]. The convergence of state-of-the-art communication technologies exposes SCADA systems to all the inherent vulnerabilities of these technologies. According to the research result published in 2017 by Kaspersky Lab on the threats landscape for industrial automation systems [START_REF] Olegovich | Towards risk potential of significant plants of critical information infrastructure[END_REF], various indus-try sectors are affected by serious vulnerabilities that operate remotely using traditional network connectivity, see Figure 1.

Vulnerabilities targeting SCADA systems have increased significantly since 2009, according to the Open Source Vulnerability Database (OSVDB) [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF]. Different actors have different motivations Fig. 1. The number of vulnerabilities identified in various industries, published in 2017 [START_REF] Olegovich | Towards risk potential of significant plants of critical information infrastructure[END_REF].

for identifying and exploiting SCADA vulnerabilities. For example, state-based actors are interested in vulnerabilities related to the critical infrastructure, and criminals or hackers are more interested in stealing intellectual property and sabotaging industrial processes. Therefore, the nature of SCADA attacks has shifted from small scale, insider-based attacks to external threat and large-scale attacks. For example, prior to the year 2000, the majority of the reported incidents impacting SCADA networks were either due to accidents or due to disgruntled insiders acting maliciously. Since 2009, there has been a sharp increase in the total number of reported incidents and most of them (above 70%) are attacks originating from the Internet [START_REF] Mohsen | An unsupervised anomaly-based detection approach for integrity attacks on SCADA systems[END_REF].

Numerous malicious attacks have posed serious and evolving security threats to SCADA systems. Practically, there is no security countermeasure that can completely protect a target system from potential threats. An Intrusion Detection System (IDS) [START_REF] Escamilla | Intrusion Detection: Network Security Beyond the Firewall[END_REF] is one of the security solutions that has demonstrated promising results in detecting malicious activities in traditional IT systems. The source of audit data and the detection methods are the main, salient parts in the development of the IDS. The network traffic, system-level events and application-level activities are the usual sources of audit data. The detection methods are categorized into two strategies: signature-based and anomaly-based. The former searches for an attack whose signature is already known, while the latter searches for activities that deviate from an expected pattern or from a predefined model of normal behavior of the system.

Due to the differences between the operational nature and characteristics of traditional IT and SCADA systems, there is a need for the development of SCADA-specific IDS. As a consequence, a number of IDS schemes based on machine learning approaches have been investigated, proposed, and developed by the research community and the networking industry over the past ten years. We have used Microsoft Academic search engine [START_REF] Sinha | An overview of Microsoft Academic Service (MAS) and applications[END_REF] to estimate the popularity in machine learning based IDS approaches since 2007.

Figure 2 shows the growth over time in the number of publications in classification/supervised, clustering/unsupervised and feature selection. The researchers have made great efforts in developing advanced supervised classification approaches-compared to unsupervised classification and feature selection approaches-in order to improve the accuracy of SCADA-specific IDS. This is due to their higher performance and accuracy compared with unsupervised classification. Thus, supervised machine learning techniques are widely used across a wide range of SCADA-specific IDS approaches. Many articles have been written that survey IDSs for critical infrastructure systems from different perspectives. For example, the survey [START_REF] Zhu | SCADA-specific intrusion detection/prevention systems: A survey and taxonomy[END_REF] emphasizes the architectures of IDS for SCADA systems. The research in [START_REF] Mitchell | A survey of intrusion detection techniques for cyber-physical systems[END_REF] focuses on classifying IDS solutions based on detection techniques and audit materials. The review in [START_REF] Holm | A survey of industrial control system testbeds[END_REF] gathers information about the testbeds used for industrial control systems. In contrast to previous reviews, the focus of this article is on Supervised Learning for SCADA-Specific IDSs. Additionally, this article analyzes existing literature based on holistic perspectives, including detection architecture, detection technique, auditing sources, and feasibility of applying the proposed IDS to the various real SCADA systems.

This survey attempts to review the field of supervised machine learning techniques used for SCADA-specific IDS and achieve the following objectives:

Propose a framework that systematically groups a collection of existing SCADA-specific IDS techniques into appropriate categories and compares their advantages and drawbacks; Present a comprehensive taxonomy of supervised machine learning techniques specifically used for SCADA-based IDSs; and Propose an evaluation metric to allow theoretical analysis of the most representative supervised machine learning algorithms from each category, with respect to the requirements of SCADA-specific IDSs.

In summary, the proposed survey presents a taxonomy of supervised machine learning techniques used for SCADA-specific IDS and proposes a categorizing framework that covers major factors in the selection of a suitable technique for SCADA-specific IDS.

The rest of this paper is organized as follows. Section 2 provides useful background for readers on the basics of SCADA systems. Section 3 presents a taxonomy of SCADA-specific IDSs. Section 4 provides a brief overview and a taxonomy of supervised-machine learning-based IDSs. Section 5 provides the evaluation of SCADA-based IDS supervised learning, and theoretically analyze the most representative supervised machine learning algorithms for SCADA-specific IDSs. Section 6 discusses the research gaps. We conclude this article in Section 7 and discuss future research.

BACKGROUND

This section presents an introduction to the key architectural concepts of a SCADA system as well as the classification of SCADA-based IDSs. In order to distinguish between the SCADA and a • • • generic ICT system, we also discuss threats and vulnerabilities of the SCADA that lead to specific requirements for the IDS of such system.

SCADA Systems

SCADA is widely used in an industrial system that continuously monitors and controls many different sections of industrial infrastructure. Applications include but are not limited to oil refineries, water treatment and distribution systems, transport systems, manufacturing plants, and electric power generation plants. A SCADA system gathers measurements-collects data from the deployed field devices-and sends them to a central site (normally a control center) for further processing and analysis. The information and status of the supervised and monitored processes are displayed at the base station or at the utility center. As such industrial systems are large and complex, a central master unit continuously and remotely monitors and controls different sections of the plant to guarantee their proper functioning.

SCADA Components

The main components of a typical SCADA system include the following: Master Terminal Unit (MTU), Programmable Logic Controller (PLCs), Remote Terminal Unit (RTU), Intelligent Electronic Device (IED), Human Machine Interface (HMI), and Communication Media [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF].

Master Terminal Unit (MTU): This is the core of a SCADA system that gathers information from the distributed RTUs and analyzes it to control the various processes [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF]. A plant's data is analyzed through histogram generation, standard deviation calculation, and plot-ting one parameter with respect to another. Based on the performance results, an operator may decide to monitor any channel more frequently, change the limits, or shut down the terminal units. The software can be designed according to the applications and the type of analysis required. The operator may be interested in finding the best operating steps for a plant which will minimize the overall operating cost. To solve this problem, engineers often employ different optimization techniques on the collected data to determine the best operating process. The operating process is then converted to appropriate operating signals and then sent to the remote terminal units RTUs through communication pathways (e.g., radio links, leasedline, or fiber optic [START_REF] Gao | SCADA communication and security issues[END_REF]). Field Devices (RTUs, PLCs, and IEDs): These are computer-based components deployed at a remote site to gather data from sensors and to control actuators [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF]. Each field device may be connected to one or more sensors and actuators that are directly connected to physical equipment (e.g., pumps, valves, motors). The main function of such devices is to convert the electrical signals received by sensors into digital values in order to send them to the MTU for further processing and analysis using some specific communication protocol (e.g., Modbus [START_REF]Modbus messaging on tcp/ip implementation guide v1. 0a[END_REF]). On the other hand, they can convert a digital command message received by MTU into an electrical signal in order to control actuators that are controlling some physical aspects of the controlled system. Different field-level devices, e.g., RTUs, PLCs, and IEDs, that are deployed at remote sites perform different functions. RTUs collect data from sensors and send it back to the MTU, and then the MTU takes a decision based on this data and sends commands to different actuators. In addition to the same function of RTUs, PLCs can collect data from sensors and based on the collected data, they can send commands directly to actuators using a local loop. In other words, PLCs can processes the data locally and take the decision without contacting MTU. IEDs are part of control systems such as transformers, circuit breakers, sensors, and the like, and they can be controlled via PLCs or RTUs.

• •

Human-Machine Interface (HMI):

This provides an efficient human-machine interface through which an operator can monitor/control end devices, such as sensors and actuators. An HMI graphically displays information on the current state of the supervised and controlled process including alerts, warnings, and urgent messages. In addition, the HMI allows the user to interact with the system using switches, buttons, and other controls [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF]. Historian: This is a database that stores the different types of data gathered by the SCADA system, such as measurement and control data, events, alarms, and operator activities. This data is used for historical, auditing, analysis, and operational purposes [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF].

SCADA Architecture

A SCADA network provides the communication infrastructure for different field devices (e.g., PLCs and RTU) of a plant. These field devices are remotely monitored and controlled throughout the SCADA network. To make the network communication more efficient and secure, many modern computing technologies have evolved from a monolithic system to a distributed system and to the current inter-networked systems [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF].

Monolithic Systems (1st Generation

). The monolithic SCADA system is considered to be the first generation SCADA system [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF]. At that time, networks were non-existent in general, and therefore a SCADA system was deployed as a stand-alone system, and no connectivity to other systems existed. As can be seen in Figure 3, a SCADA master used Wide Area Networks (WANs) to communicate with field devices using communication protocols that were developed by vendors of field devices. In addition, these protocols had limited functionality-they could only do scanning and controlling over points within certain types of RTUs. The communication between the master and field devices (e.g., RTUs) was carried out at the communication bus level using proprietary adapters. To avoid system failures, two identically equipped mainframe systems were used: one as the primary and the other as a backup. The latter was designed to take over when a failure of the primary system was detected. Figure 3 illustrates the typical architecture of this type of SCADA architecture.

Distributed Systems (2nd Generation). Figure 4 depicts a typical second generation SCADA architecture. With the development of Local Area Networking (LAN) technologies, the second generation of SCADA system distributes the processing to multiple systems and assigns a specific function for each station [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF]. In addition, multiple stations could be connected to a LAN to share information with each other in real time. For instance, the communication server can be set up to communicate with field devices such as PLCs and RTUs. Some of the distributed stations can be an MTU, a Historian, or an HMI server. The distribution of system's functionalities across the network-connected systems increases the processing power, reduces the redundancy, and improves the reliability of the system as a whole. In this generation, system failures are addressed by keeping all stations on the LAN in an online state during the operation time, and if one station (e.g., HMI station) fails, then another HMI station takes over.

Networked Systems (3rd Generation). Unlike the second generation, a third generation SCADA system is based on an open system architecture, rather than vendor-controlled proprietary solutions. One of the major differences is that the third generation can utilize open standard protocols and products. Consequently, the SCADA functionalities can be distributed across a WAN and not justa LAN [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF]. For instance, most field devices can be connected directly to the MTU over an Ethernet connection. This open system architecture allows various products from different vendors to be integrated with each other to build a SCADA system at low cost. In addition, a remote field device can be supervised and controlled from any place and at any time using the Internet. Figure 5 shows the architecture of a typical third generation networked SCADA system.

Different Types of SCADA-Based Intrusion Detection Systems

An IDS is an autonomous hardware, software, or combination of both systems that can detect threats in a SCADA system by monitoring and analyzing network or device activities from both internal and external attackers. In traditional IT systems, IDS can be classified into network-based and hostbased IDS [START_REF] Denning | An intrusion-detection model[END_REF] depending on the location of the collected data and logs. However, due to the different nature of SCADA systems in terms of architecture, functionalities, and operating devices, SCADA-based IDS, within the scope of this article, are categorized based on only the source of collected data: SCADA network-based IDS and SCADA application-based IDS.

SCADA Network-Based IDSs

A SCADA network-based IDS [START_REF] Gross | Secure selecticast for collaborative intrusion detection systems[END_REF][START_REF] Linda | Neural network based intrusion detection system for critical infrastructures[END_REF][START_REF] Ning | Constructing attack scenarios through correlation of intru-sion alerts[END_REF][START_REF] Valdes | Communication pattern anomaly detection in process control systems[END_REF] captures the data packets that are communicated between devices such as point-to-point between RTU/PLC, and between RTU/PLCs and the MTU. If a packet is a suspicious one, the security team will be sent an alarm for further investigation. An advantage of a SCADA network-based IDS is their lower computation costs, as only information in the packet's header is needed during the investigation process, and therefore a SCADA network packet can be analyzed on-the-fly. Consequently, traffic from larger networks can be inspected within a short period of time [START_REF] Linda | Neural network based intrusion detection system for critical infrastructures[END_REF]. When there is high network traffic however, a SCADA networkbased IDS may experience issues in monitoring all the packets and might miss some attacks.

However, the key weakness is that the operational behavior of the underlying SCADA processes cannot be inferred from the information provided at the network level (e.g., IP address, protocol, port,and so on). For example, if the payload of the SCADA network packet contains a malicious message, which is crafted at the application level, the SCADA network-based IDS cannot detect it, particularly when this is not violating the specifications of the protocol being used, or the communication pattern between SCADA networked devices [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF][START_REF] Carcano | A multidimensional critical state analysis for detecting intrusions in SCADA systems[END_REF][START_REF] Nai Fovino | Modbus/DNP3 state-based intrusion detection system[END_REF][START_REF] Nai Fovino | Critical state-based filtering system for securing SCADA network protocols[END_REF].

SCADA Application-Based IDSs

SCADA data, which comprises the measurements and control data generated by sensors and actuators, represents the majority of the information. Using this data, the operational behavior of a given SCADA system can be inferred [START_REF] Carcano | A multidimensional critical state analysis for detecting intrusions in SCADA systems[END_REF][START_REF] Nai Fovino | Critical state-based filtering system for securing SCADA network protocols[END_REF][START_REF] Rrushi | Composite Intrusion Detection in Process Control Networks[END_REF][START_REF] Wenxian | Wind turbine condition monitoring and reliability analysis by SCADA information[END_REF][START_REF] Zaher | Online wind turbine fault detection through automated SCADA data analysis[END_REF]. In contrast to SCADA network-based IDSs that only inspect network level information, a SCADA application-based IDS can inspect high-level data (i.e., SCADA data) to detect the presence of unusual behavior. For example, SCADA network-based IDSs are often unable to detect high-level control attacks [START_REF] Wei | Protecting smart grid automation systems against cyberattacks[END_REF] from packet headers; which can be detected by analyzing SCADA data [START_REF] Rrushi | Composite Intrusion Detection in Process Control Networks[END_REF].

Since the information source of a SCADA application-based IDS can be gathered from different remote field devices, the following are the various ways to deploy a SCADA application-based IDS [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF]: (i) It can be deployed in the historian server, as this server is periodically updated by the MTU server which acquires, through field devices, such as PLC and RTU, the information and status of the monitored system for each time period. However, this type of deployment raises a security issue when the information and status stored in the historian differ from the realtime data in the field. This could occur when the MTU server has been compromised or the data has been changed using False Data Injection attacks [START_REF] Anwar | False data injection attack targeting the LTC transformers to disrupt smart grid operation[END_REF][START_REF] Anwar | Ensuring data integrity of OPF module and energy database by detecting changes in power flow patterns in smart grids[END_REF][START_REF] Verba | Idaho national laboratory supervisory control and data acquisition intrusion detection system (SCADA IDS)[END_REF]; (ii) It can also be deployed in an independent security hardened server, which from time to time acquires information and statuses from the monitored field devices [START_REF] Nai Fovino | Modbus/DNP3 state-based intrusion detection system[END_REF]. Consequently, the large number of requests from this server might increase the network overheads resulting in degraded performance of the IDS; (iii) Each adjacent field device can be connected with a server running a SCADA application-based IDS, which is similar to the work proposed in [START_REF] Alcaraz | Diagnosis mechanism for accurate monitoring in critical infrastructure protection[END_REF] and [START_REF] Alcaraz | WASAM: A dynamic wide-area situational awareness model for critical domains in smart grids[END_REF]. However, the key issue is that SCADA data is directly/indirectly correlated, and therefore sometimes there is an abnormality in a parameter not because of itself, but due to anomalous value in another parameter [START_REF] Carcano | A multidimensional critical state analysis for detecting intrusions in SCADA systems[END_REF][START_REF] Nai Fovino | Critical state-based filtering system for securing SCADA network protocols[END_REF]. Therefore, it would be appropriate to identify and monitor correlated parameters, such as sensor readings related to a single process.

Signature-Based vs. Anomaly-Based SCADA IDS Approaches

Many types of SCADA-based IDS have been proposed in the literature, and these fall into two broad categories in terms of the detection strategy [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF]: signature-based detection [START_REF] Chen | A digest and pattern matching-based intrusion detection engine[END_REF][START_REF]IDS-signatures/modbus-tcp[END_REF] and anomalybased detection [START_REF] Ahmed | An investigation of performance analysis of anomaly detection techniques for big data in SCADA systems[END_REF][START_REF] Gross | Secure selecticast for collaborative intrusion detection systems[END_REF][START_REF] Alampalayam | Statistical based intrusion detection framework using six sigma technique[END_REF][START_REF] Linda | Neural network based intrusion detection system for critical infrastructures[END_REF][START_REF] Ning | Constructing attack scenarios through correlation of intru-sion alerts[END_REF][START_REF] Valdes | Communication pattern anomaly detection in process control systems[END_REF][START_REF] Yang | Anomaly-based intrusion detection for SCADA systems[END_REF].

A signature-based IDS detects malicious activities in a SCADA system's network traffic or in its application events. It does this by using pattern matching techniques to detect telltale events against a database of signatures [START_REF]IDS-signatures/modbus-tcp[END_REF] or fingerprints [START_REF] Chen | A digest and pattern matching-based intrusion detection engine[END_REF] of known attacks. The false positive rate (i.e., incorrectly identifying a normal event as an attack) in this type of IDS is very low and can ap-proach zero. Moreover, the detection time can be fast because it is based only on the use of a match-ing process during the detection phase. Despite the aforementioned advantages of signature-based IDSs, they typically fail to detect new attacks (e.g., zero-day) whose signatures are not known, or which do not exist in its database. Therefore, the database must be constantly updated with pat-terns of new attacks.

An anomaly-based IDS assumes that the behaviors of intrusive activities are noticeably distinguishable from normal behavior [START_REF] Denning | An intrusion-detection model[END_REF]. The "normal model" is created using a realistic training set using advanced mathematical/statistical techniques. Any significant deviation from this model is flagged as an anomaly or potential attack. For example, normal SCADA network traffic can be obtained over a period of normal operations, and then a modeling technique is applied to build the normal SCADA network profiles. During the detection phase, the deviation degree between the current network traffic and the created normal network profile is computed: if the deviation exceeds the predefined threshold, the current network traffic will be flagged as an intrusive activity. The primary advantage of anomaly-based IDSs compared to signature-based ones is that new or unknown attacks can be detected, although it generally suffers from a higher false positive rate (i.e., detecting normal behavior as malicious).

SCADA Threats and Vulnerabilities

When SCADA was initially suggested, the focus was on efficiency and effectiveness without considering the potential security issues it might encounter in the future. As security concerns became more critical, it was discovered that it was not easy to address such issues, since an upgrade or replacement of a vital SCADA network in an old industrial system can disrupt the production or management of existing critical processes and services [START_REF] Vinay | Security issues in SCADA networks[END_REF]. SCADA was also originally developed for isolated systems. Modern critical infrastructure has since been interconnected via the Internet network to increase scope and capability and we have thus seen various new attacks on the systems. An example is the Havex malware that allows attackers to remote access and controls the system using a backdoor channel. Such malware affected victims in numerous industries, including sections of energy, aviation, and defense to name a few. The Stuxnet worm that targets PLC devices and gives unexpected commands to the infected control device [START_REF] Yang | Multidimensional intrusion detection system for IEC 61850-based SCADA networks[END_REF]. This threat primarily targets Iran's nuclear program. The SQL Slammer worm that exploits buffer overflow vulnerability and performs DoS on the infected system (i.e., Davis-Besse-the American nuclear power plan). We categorize vulnerabilities of the SCADA into three aspects as follows:

Hardware. The SCADA system is geographically distributed (i.e., covering regions of cities), and many low-level controllers/sensors are wirelessly interconnected. As a result, it is hard to prevent attackers from accessing SCADA components, wirelessly or even physically. For instance, attackers could intercept the wireless communication signal using tools like Aircrack-NG [START_REF] Thomas D'otreppe De Bouvette | Aircrack-ng -Main documentation[END_REF] to gain access to the network. In the field, it is even possible that attackers intrude into the station and direct access to the control device (e.g., using the USB drive malware).

The physical component also has a tight relationship with its software counterpart. Hence, an attack with a series of malicious commands could severely affect the hardware. An example is the Aurora Generator Test showing the destruction of the electric generator by remotely attack from the network [START_REF] Weiss | Aurora generator test[END_REF]. Furthermore, the inclination to use COTS devices in SCADA system makes the system more vulnerable. Since the COTS equipment has a generic design and protocol standards, it has become a target of exploitation [START_REF] Vinay | Security issues in SCADA networks[END_REF].

Software. SCADA-specific protocols use plaintext messages to communicate between sensorsactuators (e.g., Modbus, DNP-3, IEC 60870-5-101, and IEC 60870-5-104). These simple communications can be easily manipulated by false data injection attacks [START_REF] Anwar | Vulnerabilities of smart grid state estimation against false data injection attack[END_REF][START_REF] Anwar | False data injection attack targeting the LTC transformers to disrupt smart grid operation[END_REF][START_REF] Anwar | Modeling and performance evaluation of stealthy false data injection attacks on smart grid in the presence of corrupted measurements[END_REF][START_REF] Anwar | Identification of vulnerable node clusters against false data injection attack in an AMI based smart grid[END_REF]. Here attackers inject (e.g., using man-in-the-middle (MITM) technique) a fake measurement into a closed loop control system. This can disrupt or even stop the critical system.

Patching the newly discovered vulnerability can be complicated for a SCADA system. Since the distributed control components are mostly Windows-or Linux-based computers, inherited vulnerabilities are inevitable. Unfortunately, with the availability requirement and diversity of system components, appropriate security patches might take several months to arrive [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF]. This is because system components might come from different manufacturers, using various standards or proprietary protocols. In some cases, software/hardware is being used for the extended period of time after the end of the manufacturer-supported warranty [START_REF] Nazir | Assessing and augmenting SCADA cyber security: A survey of techniques[END_REF].

Security Administration and Insider Attacks. Apart from the security technology, attackers could harvest information using social engineering to attack employees of the targeted organization. A bad security practice, such as weak passwords or bad configurations, could make the SCADA system vulnerable. On the other hand, an angry former employee could hack into the system and cause devastating damages to the system. For instance, there was an incident in Queensland, Australia in which a a former staff member of the Maroochy Water Services flooded millions liters of sewage water into parks and rivers by using a radio transmitter and a computer from his car [START_REF] Abrams | Malicious control system cyber security attack case study-Maroochy Water Services[END_REF].

Requirements of SCADA-Based IDSs

SCADA is distinguished from a traditional IT system by such key characteristics as availability and reliability . It also includes a wide range of proprietary COTS components, i.e., the cyber-physical components that are tightly coupled. Hence, the key requirements for a SCADA-specific IDS can be listed as follows:

(1) Availability and Robustness: According to the availability constraint, the IDS technology does not only require anomaly detection that covers both known and unknown attacks, it also requires support for a model updating mechanism that minimizes downtime. With regard to robustness, the IDS has to be compatible with incomplete features gathered from different platforms to allow components from diverse manufacturers to be used. Furthermore, the security system has to deal with training/detecting data that contains a little portion of attacks event and lots of noises [START_REF] Naser Mahmood | Network Traffic Analysis and SCADA Security[END_REF]. (2) Scalability and Resilience: Despite a large number of logs that are continuously generated from a number of sensors/controllers, the detection module should not slow down the manufacturing or control process. Conversely, it should give timely automated protection and alarms. Since a decentralized or distributed IDS could be an answer to the scalability issue, the design of algorithms should also account for the possibility that detection devices may themselves be compromised or fail [START_REF] Genge | A framework for designing resilient distributed intrusion detection systems for critical infrastructures[END_REF]. To extend scalability without scarifying availability, resilience is also an important requirement. (3) Information Aggregation and Correlation: Since a SCADA system has a tight cyber-physical relationship [START_REF] Mohsen | Designing Unsupervised Intrusion Detection for SCADA Systems[END_REF], the IDS should be able to make use of multiple attributes in detecting anomalies. The SCADA system integrates Operational Technology (OT), such as sensors and actuators, as well as Information Technology (IT), such as databases, servers, firewalls, and routers. As a result, the SCADA-specific IDS has to support aggregation and correlation of variables from multiple sources. Besides, manipulation of either cyber or physical world could affect one another. For instance, a false-data injection attack [START_REF] Anwar | False data injection attack targeting the LTC transformers to disrupt smart grid operation[END_REF] that infiltrates fake measurement data into the system to cause physical disruption. Hence, it is important to monitor anomaly from a holistic perspective, including cyber perspective (i.e., network communication, application behavior) and physical perspective (e.g., signals from sensors/controllers). ( 4) Feasibility: As the nature of the SCADA system can be different depending on the application (e.g., electric power distribution, water supply system, and manufacturing process control system), the practicality study of the proposed system is crucial. In addition, the completeness of assessing the proposed model is also important for the critical infrastructure system. Despite the limited research and development cost, the same system can act differently on different evaluation environment (e.g., tested on a simulator, SCADA test-bed and implementing the real system).

TAXONOMY OF SCADA-BASED IDSS

Protecting a SCADA system from intrusion is a challenging task because it not only inherits many of the existing ICT vulnerabilities but also includes vulnerabilities from the OT field components.

In addition, the implementation of countermeasures suffers due to the limited computational resources on the OT side. Thus, there is a need to study IDS systems used for SCADA. Motivated by the work proposed in [START_REF] Garitano | A review of SCADA anomaly detection sys-tems[END_REF], [START_REF] Jaiganesh | Intrusion detection systems: A survey and analysis of classification techniques[END_REF], [START_REF] Mitchell | A survey of intrusion detection techniques for cyber-physical systems[END_REF], [START_REF] Vávra | Evaluation of anomaly detection based on classification in relation to SCADA[END_REF], and [START_REF] Zhu | SCADA-specific intrusion detection/prevention systems: A survey and taxonomy[END_REF], the existing approaches can be classified using three different categorizations based on the requirements of SCADA-specific IDSs. Figure 6 shows our taxonomy of SCADA-based IDSs.

Function-Centric: As part of its operations, a SCADA system generates alarms for processes that go beyond their operating parameters, e.g., due to an expected or unexpected change in

•

the underlying physical processes. While this may not always correspond to an attack, alertbased responses address inherent problems in SCADA operations, which are otherwise not possible to capture using traditional IT-based IDS. Based on the requirements of the strict availability, the IDS can respond immediately to unusual situations [56, 63, 69, 91-93, 95, 132, 133, 135, 138, 141], or provide a delayed notification summarizing similar alarms [START_REF] Hurst | Big data analysis techniques for cyber-threat detection in critical infrastructures[END_REF][START_REF] Markovitz | Field classification, modeling and anomaly detection in unknown CAN bus networks[END_REF][START_REF] Moon | DTB-IDS: An intrusion detection system based on decision tree using behavior analysis for preventing APT attacks[END_REF][START_REF] Onoda | Probabilistic models-based intrusion detection using sequence characteristics in control system communication[END_REF][START_REF] Shitharth | An enhanced optimization based algorithm for intrusion detection in SCADA network[END_REF][START_REF] Tang | A local density-based approach for outlier detection[END_REF][START_REF] Vijayanand | Support vector machine based intrusion detection system with reduced input features for advanced metering infrastructure of smart grid[END_REF][START_REF] Wan | Double behavior characteristics for one-class classification anomaly detection in networked control systems[END_REF]. Information-Centric: If we examine the information used for the detection, then IDS systems can be further categorized into Host-based Intrusion Detection (HID) and Networkbased Intrusion Detection (NID). Host-based methods detect intrusions by examining data gathered from hosts, such as device memory, application logs [START_REF] Magdalena | Ensemble regression model-based anomaly detection for cyberphysical intrusion detection in smart grids[END_REF][START_REF] Shengyi Pan | Developing a hybrid intrusion detection system using data mining for power systems[END_REF][START_REF] Ponomarev | Industrial control system network intrusion detection by telemetry analysis[END_REF][START_REF] Wan | Double behavior characteristics for one-class classification anomaly detection in networked control systems[END_REF][START_REF] Yang | Multidimensional intrusion detection system for IEC 61850-based SCADA networks[END_REF][START_REF] Zhou | Design and analysis of multimodel-based anomaly intrusion detection systems in industrial process automation[END_REF][START_REF] Zohrevand | Hidden Markov based anomaly detection for water supply systems[END_REF], the change of system configuration [START_REF] Moon | DTB-IDS: An intrusion detection system based on decision tree using behavior analysis for preventing APT attacks[END_REF], Network-based methods collect data from either a network, a hub or a router and detect anomalies at the source, destination, protocol and payload from network data [START_REF] Andrysiak | Network anomaly detection for railway critical infrastructure based on autoregressive fractional integrated moving average[END_REF][START_REF] Cruz | A cybersecurity detection framework for supervisory control and data acquisition systems[END_REF][START_REF] Hosic | Evolving decision trees to detect anomalies in recurrent ICS networks[END_REF][START_REF] Krishnan | A fusion of multiagent functionalities for effective intrusion detection system[END_REF][START_REF] Maglaras | Combining ensemble methods and social network metrics for improving accuracy of OCSVM on intrusion detection in SCADA systems[END_REF][START_REF] Onoda | Probabilistic models-based intrusion detection using sequence characteristics in control system communication[END_REF][START_REF] Stefanidis | An HMM-based anomaly detection approach for SCADA systems[END_REF][START_REF] Sri Swetha | Smart grid -A network based intrusion detection system[END_REF][START_REF] Vijayanand | Support vector machine based intrusion detection system with reduced input features for advanced metering infrastructure of smart grid[END_REF].

Analysis-Centric: This category focuses on different analysis techniques for detecting outliers. As discussed in Section 2.2, this has two subgroups, namely signature-based and anomaly-based approaches. The scope of this review is anomaly-based approach, which employs various kinds of machine learning techniques.

As three previously discussed categories classify existing literature from different perspectives, a single publication can be included into three categories. For instance, References [START_REF] Yang | Multidimensional intrusion detection system for IEC 61850-based SCADA networks[END_REF], [START_REF] Zhou | Design and analysis of multimodel-based anomaly intrusion detection systems in industrial process automation[END_REF], and [START_REF] Zohrevand | Hidden Markov based anomaly detection for water supply systems[END_REF] are grouped as automatic response, host-based, and anomaly-based according to their functions, detecting sources and analysis methods.

However, since this review focuses on supervised learning algorithm, the number of reviewing literature mostly consists of anomaly based approaches. This is because the anomaly-based detection focuses on finding deviations (outliers) from the trained normal or abnormal models rather than using the pre-defined patterns of attacks to detect abnormal events, e.g., patterns of spoof Address Resolution Protocol (ARP) messages or sequence of Application Programming Interface (API) called by known malicious programs. A few numbers of signature-based approaches were in-cluded as they employed supervised learning algorithms to dynamically generate sets of signature for detecting suspicious incidents.

SUPERVISED LEARNING TECHNIQUES

Supervised learning algorithms use labeled training data to formulate detection models, e.g., set of rules [START_REF] Samdarshi | A triple layer intrusion detection system for SCADA security of electric utility[END_REF], separation plane [START_REF] Wahyudi Masduki | Study on implementation of machine learning methods combination for improving attacks detection accuracy on Intrusion Detection System (IDS)[END_REF], decision trees [START_REF] Amir Faisal | Securing advanced metering infrastructure using intrusion detection system with data stream mining[END_REF], neural network [START_REF] Magdalena | Contextual anomaly detection for cyber-physical security in smart grids based on an artificial neural network model[END_REF]. Later on, these mod-els are used to detect anomalies. Different classification techniques or classifiers are used to pre-dict anomaly, e.g., One-class Support Vector Machine OCSVM [START_REF] Yasakethu | Intelligent risk detection and analysis tools for critical infrastructure protection[END_REF], the Hidden Markov Model HMM [START_REF] Zhou | Design and analysis of multimodel-based anomaly intrusion detection systems in industrial process automation[END_REF], ANN [START_REF] Magdalena | Contextual anomaly detection for cyber-physical security in smart grids based on an artificial neural network model[END_REF], to name a few. The rest of this section presents an overview of supervised learning-based IDSs followed by a comprehensive summary of different classification techniques.

Overview of Supervised Learning-Based IDSs

Although various IDS approaches have different processes, we describe the generic process in this section to give a general idea of how the detection model is trained and used to detect attacks. Figure 7 depicts an overview of the implementation of the IDS approach in practice. In particular, such systems consist of five main processes: (A) data collection, (B) feature extraction and selection, (C) tagging, (D) training, and (E) anomaly detection. Data collection (see Figure 7(A)) represents the measurement step, where the input data is collected, e.g., logs of events or system states, traffic trace or Net-flow data from a network monitor and so on. that is usable in the classification process. The feature selection step might not be required for some machine learning approaches (i.e., ANN [START_REF] Magdalena | Contextual anomaly detection for cyber-physical security in smart grids based on an artificial neural network model[END_REF], that include network pruning and contrasting procedures which automatically select the discriminant features). In Figure 7(B.2), each data point (i.e., record) is represented using a feature vector which consists of attributes x1, x2, ... , xn (e.g., behaviors or indicators). Sometimes values of features require to be normalized at this stage to prevent feature with a large range (e.g., payload size) to overweight feature with a relatively small range (e.g., binary). For instance, Min-Max normalization [START_REF] Aksoy | Feature normalization and likelihood-based similarity measures for image retrieval[END_REF] can be used to transform the numeric value v of feature x to v J that ranges between [0, 1] as follows:

v J = v -minx , ( 1
) maxxminx where minx and maxx are the minimum and the maximum value of the feature x. Note that, each data point may not always be a tuple with a specific number of features, some instances of a sample could also be a sequence of features. We elaborate this in more detail in Section 4.2. In Figure 7(C), each training record must be labeled to identify the class (i.e., normal or attack in the context of the IDS) that the data instance belongs to, either manually or automatically, using input from an analyst or expert. In several cases, the attack incident is hard to simulate or collect from the field. For these scenarios, IDS designers use only normal dataset to train the model (e.g., [START_REF] Germano Da Silva | A one-class NIDS for SDN-based SCADA systems[END_REF], [START_REF] Maglaras | Intrusion detection in SCADA systems using machine learning techniques[END_REF], [START_REF] Nader | Intrusion detection in SCADA systems using one-class classification[END_REF], [START_REF] Nader | Detection of cyberattacks in a water distribution system using machine learning techniques[END_REF], [START_REF] Wan | Double behavior characteristics for one-class classification anomaly detection in networked control systems[END_REF], and [START_REF] Yasakethu | Intelligent risk detection and analysis tools for critical infrastructure protection[END_REF]). Figure 7(D) shows the model development process. The labeled dataset is used to train and evaluate the classification model. In order to improve the detection accuracy, parameters of the model could be adjusted, and the training/evaluation process is repeated until the anticipating efficiency is satisfied.

Once model training is complete, the model can be used to classify new instances of data. Figure 7(E) shows the process of detecting an anomaly using the classification model. Each unknown data item is labeled as either benign or malicious (most systems will provide lower-level detail for malicious points). Finally, the output of this module will be presented to the administrator to notify or take a response action.

Taxonomy of Supervised Learning Approaches

Even though there exist several machine learning classification methods/algorithms to detect anomalies [START_REF] Han | Data Mining: Concepts and Techniques[END_REF], there is a lack of a taxonomy of these methods in the literature. A proper taxonomy - is not only important to develop the evaluation matrix, but this also helps the separation between computational and architectural complexity of SCADA IDS systems. Hence, in this section, we present a structured view of classification approaches based on nine ( 9) categories (see Figure 8). Below, we describe each category in detail.

Probabilistic Method. This category predicts a class of unseen data based on probabilities. During the training phase, the presence of certain features of each class is used to calculate the distribution of joint or conditional possibility [START_REF] Sutton | An introduction to conditional random fields[END_REF]. This number reflects the probability that a particular input falls into one of the predefined classes of objects to be classified. Examples of techniques in this group are Naïve Bayes (NB), Bayesian Network, Hidden Markov Model (HMM), and Conditional Random Field (CRF).

A basic probabilistic method like NB [START_REF] Tylman | SCADA intrusion detection based on modelling of allowed communication patterns[END_REF] learns conditional probability of each feature from the training data based on the assumption that every feature can be seen independently (i.e., conditionally independent). NB predicts the class of the input based on the highest joint likelihood. Bayesian Network technique [START_REF] Friedman | Bayesian network classifiers[END_REF] generalizes NB classifier by combining Bayesian variables with directed acyclic graph structure. The vertex in the graph depicts the variable (i.e., features and class), whereas the edge represents a probabilistic relationship between these variables. The graph is used to compute posterior probability of each class given all evidence.

On the other hand, some probabilistic models work on a sequence of features instead of the fixed number of features. For instance, HMM [START_REF] Stefanidis | An HMM-based anomaly detection approach for SCADA systems[END_REF] inherits the concept of NB to predict the class of the datapoint based on a series of observable features over time. The assumption of HMM is that an observable feature is generated by the particular hidden system states. That is explained as a Markov process. The hidden state at time t depends on the previous state t 1. Once the joint probability of the future state is calculated, the likelihood of the observable sequence is determined, using knowledge of the predicted hidden states. HMM is used to classify labels of events based on sequences of features that are traced over the monitoring period. For instance, messages from a communication log are considered a sequence of features.

CRF is similar to HMM but more complicated. Instead of relying on a joint probability, the CRF works based on conditional probability [START_REF] Klinger | Classical Probabilistic Models and Conditional Random Fields[END_REF]. As a result, CRF is more flexible. In other words, it includes a wide variety of overlapping features. However, this makes CRF less efficient in terms of computational complexity issue compared to HMM. Apart from that, when the newer data ∈ becomes available, CRF model does not support re-training of the model. Therefore, it is not suitable for attacks that change over time.

Divide & Conquer Method. The divide and conquer technique includes (but not limited to) a broad category of algorithms known as the decision tree. It formulates a tree-like data structure from a set of attributes of each training tuple. Using a decision tree a rule set is easily derived, which can be used to classify the input into a particular group [START_REF] Moon | DTB-IDS: An intrusion detection system based on decision tree using behavior analysis for preventing APT attacks[END_REF][START_REF] Shengyi Pan | Developing a hybrid intrusion detection system using data mining for power systems[END_REF][START_REF] Samdarshi | A triple layer intrusion detection system for SCADA security of electric utility[END_REF]. There are several algorithms in the group, such as Classification and Regression Tree (CART), Iterative Dichotomiser (ID3), C4.5 (an improved ID3), Frequent Pattern (FP) Growth, Supervised Learning in Quest (SLIQ), SPRINT, and Random Forest (RF).

CART consists of a set of decision rules, which is described using a set of if-else rules using a structure of binary tree [START_REF] Lewis | An introduction to classification and regression tree (CART) analysis[END_REF]. The node of the tree represents a feature that is used to classify data points, while the edge represents decision paths. The path that connects more than one class is called a sub-tree. The path that yields only one class is called the leaf node and represents the final outcome. In reality, the classification node gives a mixture of instances from different categories; hence the feature that best discriminates the input data is chosen (so-called splitter). After that, the recursive process repeats at the next level of the tree until the classification reaches a leaf node. Since the method of finding the best splitter is based on the greedy approach (non-backtracking), the output decision tree might not be optimized. The tree pruning technique is the most commonly used [START_REF] Han | Data Mining: Concepts and Techniques[END_REF] to reduce the size of the tree.

The advanced decision tree techniques like ID3 and C4.5 build a decision tree in the same way, but C4.5 has been improved over ID3 in various aspects. Specifically, C4.5 handles both continuous and discrete attributes. If the attribute X R, the splitting threshold will be used to divide the data into two groups instead of the exact value of the discrete X . Apart from that, C4.5 allows the training data with some missing attribute values, and it supports tree pruning after creation. According to the research [START_REF] Moon | DTB-IDS: An intrusion detection system based on decision tree using behavior analysis for preventing APT attacks[END_REF], C4.5 is faster and more flexible compared to its precedent ID3; therefore, it is a better choice for the context of the SCADA IDS that produces variety and a large amount of the monitoring inputs data. Scalability is an important issue of tree based classifiers as the size of tree is growing when the training data is larger [START_REF] Mehta | SLIQ: A fast scalable classifier for data mining[END_REF]. Advanced decision tree techniques improve scalability and accuracy compared to the classic methods. For instance, IBM proposes SLIQ [START_REF] Mehta | SLIQ: A fast scalable classifier for data mining[END_REF] and SPRINT [START_REF] Shafer | SPRINT: A scalable parallel classifier for data mining[END_REF] algorithms, which are based on a scalable method that splits parts of the tree from the memory to the database on a hard drive to address the scalability issue.

Aside from the decision tree techniques, the divide-and-conquer approach also includes a technique that works and is based on a frequent pattern, for example, the FP-Growth algorithm. Pan et al. [START_REF] Shengyi Pan | Developing a hybrid intrusion detection system using data mining for power systems[END_REF] use FP-Growth to discover common communication patterns of the smart grid system. Then, the infrequently seen pattern is identified as an anomaly. The FP-Growth uses FP-Tree data structure to summarize patterns of events (i.e., nodes) that frequently occur together (i.e., edges of the tree). Although the FP-Growth technique is efficient, the data structure might be too large to fit in the main memory.

Rule-Based Method. This method uses a set of rules to determine classes of inputs. Undeniably, the rule is easier for a human to understand the reason behind a decision, compared to the probabilistic and numerical models. A rule generally contains condition and conclusion parts. The conclusion is the output of the classification, whereas the condition is the features of particular object that are being classified. The efficiency of rule-based method is measured by coverage and accuracy. Coverage shows how many tuples in the dataset satisfy by the condition. The accuracy determines the number of tuples that apply the conclusion. A definition of rules set is either specified by specialists of the particular system or mined from the training data using various supervised learning techniques.

| | | → -| | | | | | → -| | | | | → -
With respect to automate rules discovery approach, a set of rules can be extracted from the training data. This process can be done by sequential covering algorithms or decision tree methods [START_REF] Han | Data Mining: Concepts and Techniques[END_REF]. The sequential covering approach extracts rules from training data one-by-one in sequence, whereas the decision tree formulates a multiple tree-like structure of decision rules. There are many different rules mining approaches, such as Classification Based on Associations (CBA) [START_REF] Liu | Integrating classification and association rule mining[END_REF], CN2 [START_REF] Clark | The CN2 induction algorithm[END_REF], Multiple Association Rules (CMAR) [START_REF] Li | CMAR: Accurate and efficient classification based on multiple classassociation rules[END_REF] and Repeated Incremental Pruning to Produce Error Reduction (RIPPER) [START_REF] Cohen | A simple, fast, and effective rule learner[END_REF].

The simple method like CBA [START_REF] Liu | Integrating classification and association rule mining[END_REF] , sup% and conf %) that determine if the rule should be selected for the classification. Although the selected rules are the most effective, they might not be the best discrimination. In addition, a scalability issue is an important limitation. That is, the rule-based method scales poorly with the large training data, especially when outliers cannot be avoided compared to the decision tree method (i.e., C4.5) [START_REF] Cohen | A simple, fast, and effective rule learner[END_REF].

The more sophisticated approaches like CMAR and RIPPER, on the other hand, aim to increase the robustness of the approach by eliminating impurities from the training data and reducing the number of rules generated from the training phase. CMAR [START_REF] Li | CMAR: Accurate and efficient classification based on multiple classassociation rules[END_REF] extends FP-Growth technique [START_REF] Shengyi Pan | Developing a hybrid intrusion detection system using data mining for power systems[END_REF] to formulate a Class-Association Rules (CR)-Tree and minimizes memory space requirement (e.g., by using tree pruning technique); hence, CMAR has a better classification accuracy and scalability compared to the classic CBA and C4.5 algorithms. RIPPER [START_REF] Pan | Anomaly based intrusion detection for building automation and control networks[END_REF] aims to address the impurity issue by proposing an iterative pruning technique for reducing error and allow a large and noisy training dataset to be used. More specifically, the training data is divided into growing and pruning sets. The growing part is used to formulate a rule-set, whereas the new set of rules is pruned immediately with the pruning dataset until there is no improvement from the pruning step. The new set of rules is integrated with a rule-set from the previous iteration.

Lazy Learning Method. This method differs from others in terms of the learning process. The main idea behind the technique is to update the training model as late (hence, lazy) as possible. For example, the training data is stored in the memory without building a prediction model like an eager learning technique. The prediction model is only built during the classification step. It offers both advantages and disadvantages. Even though the lazy learning method offers the best performance at the learning step, this advantage is a tradeoff of computational complexity when it is making a prediction or classification. However, it is more flexible than others because the trained model can be incrementally improved [START_REF] Silva | On the Use of K-NN in Intrusion Detection for Industrial Control Systems[END_REF][START_REF] Tang | A local density-based approach for outlier detection[END_REF].

The most commonly used lazy learning technique is the k-Nearest-Neighbor (k-NN) technique [START_REF] Shah | Subset selection classifier (SSC): A training set reduction method[END_REF]. It compares the input with k data points using Euclidean distance function. An advanced method, like Kernel Density Estimation (KDE), implements k-NN-based approach (e.g., nearest neighbors, reverse neighbors, and shared neighbors [START_REF] Schilling | Mutual and shared neighbor probabilities: Finite-and infinite-dimensional results[END_REF]) as a kernel function that is used to formulate the density function (i.e., multivariate Gaussian [START_REF] Tang | A local density-based approach for outlier detection[END_REF]) of the normal data; hence, the boundary of the normal can be described using parameters of the density function. Given that one data point contains n features, the anomaly is detected by projecting the data point into ndimension space of features. The data point that resides beyond the normal boundary is considered an anomaly.

Boundary Method. Unlike the lazy learning method, this method considered an eager learner. Support Vector Machine (SVM) [START_REF] Cortes | Support-vector networks[END_REF] is the most common technique in this category. It transforms the training data into a decision boundary (so-called hyperplane). The idea of hyperplane is that the training data with non-linear mapping is transformed into an adequate higher dimension, where two classes can be linearly separated by the hyperplane. Also, the algorithm aims to maximize the width of the separation plane. Despite the training time being very long, this approach dominates other methods by being less prone to over-fitting on the training data. The SVM-based solution is quite common for SCADA-IDS. In practice, it is combined with other techniques (such as pruning and kernel-trick) to archive a higher detection accuracy [START_REF] Wahyudi Masduki | Study on implementation of machine learning methods combination for improving attacks detection accuracy on Intrusion Detection System (IDS)[END_REF], lower false positive and negative alarm [START_REF] Patel | A nifty collaborative intrusion detection and prevention architecture for smart grid ecosystems[END_REF], minimize an offline learning phase [START_REF] Patrascu | Cyber protection of critical infrastructures using supervised learning[END_REF], or to apply with environment where input features are limited [START_REF] Vijayanand | Support vector machine based intrusion detection system with reduced input features for advanced metering infrastructure of smart grid[END_REF].

Another example of the boundary method includes technique in the research [START_REF] Markovitz | Field classification, modeling and anomaly detection in unknown CAN bus networks[END_REF]. The proposed technique is used to identify anomaly for proprietary communication (e.g., vehicle CAN bus protocol). Since the communication protocol is not disclosed by manufacturer, it is challenging to detect attacks on those critical system. Markovitz and Wool [START_REF] Markovitz | Field classification, modeling and anomaly detection in unknown CAN bus networks[END_REF] identify field boundaries based on the pre-defined knowledge of control variables and the actual control signals from various operations situations. After that, they are able to train a classifier, which is used to detect anomaly. Although the proposed technique is specific to the particular control system, the same principle could be applied when communication specification is unknown.

Evolutionary Method. The evolution of a living organism inspires the development of artificial intelligent techniques. Various techniques have been proposed for SCADA-IDS (e.g., [START_REF] Magdalena | Contextual anomaly detection for cyber-physical security in smart grids based on an artificial neural network model[END_REF], [START_REF] Anna | Disturbance detection for optimal database storage in electrical distribution systems using artificial immune systems with negative selection[END_REF], [START_REF] Linda | Neural network based intrusion detection system for critical infrastructures[END_REF], and [START_REF] Shitharth | An enhanced optimization based algorithm for intrusion detection in SCADA network[END_REF]). There are two well-known techniques, namely, Artificial Neural Network (ANN) and Genetic Algorithm (GA). ANN uses a brain-like structure (i.e., a network of neural cells) for classification. The neural network consists of three different layers of nodes, namely input layer, hidden layer(s), and output layer. The input layer can contain several nodes depending on the input data (e.g., number of features of each tuple). Every input node has connections with every nodes in the hidden layer. The connections have different weight values; these weights are fitted during the training period in order to provide the most accurate output according to the supervised knowledge. There can be more than one hidden layer of the neural network. Even though ANN gives a high prediction accuracy in various applications (e.g., image/voice recognition, misuse behavior and anomaly detection), the explanation of how ANN works is still controversial [START_REF] Bishop | Neural Networks for Pattern Recognition[END_REF]. Researchers do not fully understand how the ANN classifies the input data, and designing of the ANN topology (i.e., number of nodes and hidden layers) is still trial and error. The output layer could be only one node in case of a binary classification problem. That is, giving output between 0 and 1, which serves as a likelihood of being a particular class. For multi-class classification problem, the number of output could be k nodes, represent the prediction of k-classes. Each output node indicates likelihood of each class. Important limitations of ANN technique are the requirement of a large training dataset and the trained model might be over-fitted to the training set; hence, it is not applicable in some contexts. For example, recording all possible attack data from the real SCADA system.

The GA algorithm [66], on the other hand, simulates the process of selective survival in the evolution theory. It assumes that the knowledge (e.g., anomaly detection rules) can be represented as a chromosome of the living things. These chromosomes can be optimized according to evaluation objectives. In context of IDS, design of evaluation function is crucial to optimize the fitness of the outcome. GA is well known for minimizing the effect of erroneous training sets and sometimes overcomes the problem of multiple local optima. Other aspects of nature are also applied in anomaly detection. Negative Selection Algorithm (NSA) or Immune Network Algorithm (INA)

≥ r ∈ → - ••• ••• 2 vr i=1
[68] formulates the detector module for the classification between normal and abnormal data. The idea was initially derived from the organic process where immune cells detect harmful agents in our body.

Unary Classification. Unary or one-class classification (OCC) solves the binary or multi-class classification problem by primarily learning from a training set of one class only (i.e., normal system states); hence, the anomaly can be detected as the class of others. This approach advantages other solution when one class of the training data can be clearly observed, while information of other classes is severely hard to record.

The most common algorithm in this category is One-Class Support Vector Machine (OCSVM) (so-called Support Vector Data Description: SVDD), e.g., [START_REF] Germano Da Silva | A one-class NIDS for SDN-based SCADA systems[END_REF], [START_REF] Maglaras | Intrusion detection in SCADA systems using machine learning techniques[END_REF], [START_REF] Nader | Intrusion detection in SCADA systems using one-class classification[END_REF][START_REF] Nader | lp-norms in one-class classification for intrusion detection in SCADA systems[END_REF][START_REF] Nader | Detection of cyberattacks in a water distribution system using machine learning techniques[END_REF], [START_REF] Wan | Double behavior characteristics for one-class classification anomaly detection in networked control systems[END_REF], and [START_REF] Yasakethu | Intelligent risk detection and analysis tools for critical infrastructure protection[END_REF]. Therefore, the basic principle of the SVDD technique is similar to the SVM technique, discussed previously. Instead of separating between two classes using a linear hyperplane. In higher dimensional space of the data, SVDD formulates boundary function of a spherically shaped that minimally covers the complete population of the target class [START_REF] David | Support vector data description[END_REF]. Let the sphere is described by the center a and radius R 0, SVDD aims to minimize volume of the sphere by minimizing value of R 2 described in the error function as,

minimize F (R, a) = R , subject to ǁxi -aǁ 2 ≤ R 2 , ∀i, (2)
where xi denotes distance between the data point i and the center a. However, the perfect spherical shape could also include outliers from the training set (hence, not optimized). According to [START_REF] David | Support vector data description[END_REF], the separation plane is formulated by resolving the following optimization problem:

minimize 1 ǁω ǁ 2 + 1 . ξi -ρ, subject to (ω • Φ(xi )) ≥ ρ -ξi , ξi ≥ 0, i = 1 • • • r , ( 3
)
where xi X is a data point out of total r samples in the training set X , and Φ : X H denotes the mapping function from raw to the high-dimensional space. The normal vector and compensation parameter of the hyperplane H is denoted by ω and ρ, respectively; v = (0 1) is a tradeoff parameter that controls proportion of support vectors in the training set. Lastly, ξi represents the slack variable that allows some training samples to be incorrectly classified. This optimization problem is solved using Lagrange multiplier, which can find detail in the further reading [START_REF] David | Support vector data description[END_REF].

Density-Based Method. This method builds an estimate function from statistical data based on the training set. It can be used for both clustering and classification problems. Examples of algorithms in this group are Expectation Maximization (EM), Logistic Regression (LR) and Linear discriminant analysis (LDA). EM is an iterative approach, and it works well on incomplete training data [START_REF] Dempster | Maximum likelihood from incomplete data via the EM algorithm[END_REF]. In the training period, it adjusts parameters of likelihood function based on the data point from the previous round. The aim is to optimize settings of the likelihood function. This process repeats on the next round until the stopping criteria are met (e.g., difference of output is zero or remain unchanged). Since the EM technique maximizes the accuracy of the classification function, the advanced IDS solution [START_REF] Yoo | Novel approach for detecting network anomalies for substation au-tomation based on IEC 61850[END_REF] incorporates EM technique into one-class classifier to reduce the outlier from the training data set in the pre-processing phase to get the more accurate classification model.

Logistic regression (LR) [START_REF] Kleinbaum | Applied Regression Analysis and Other Multivariable Methods[END_REF], on the other hand, is mainly used for binary classification problem. It maps value of each feature, e.g., payload size x = (1 100) of the network traffic, with likelihood of the predicting class (say malicious and benign). Basically, the technique tries to fit all data points in the sigmoid curve by shifting the line and re-calculate the likelihood until the maximum likelihood value is found. An important limitation of LR technique is when classes have a complete separation. That is, some features can separate two classes; hence, the binary function cannot be used to classify the input.

The more advanced technique like LDA [START_REF] Mika | Fisher discriminant analysis with kernels[END_REF] is suitable for classifying data with multiple classes and multiple features (so-called dimension). Data point x with n features can be plotted on a ndimensional space to find a separation point, separation line, or separation plane, when n = 1, 2, 3 respectively. In reality, data might have more than 3 dimensions. Hence, it is complicated to calculate the separation plane directly. LDA resolves this problem by reducing complexity of data dimensions. In case of binary classification, it creates a new axis and projects all data points onto the new axis. Regardless of the feature dimension, data points of two classes can be separated on the new axis. The new axis is formulated from the training data by maximizing the combination of means of data points in each class and minimizing combination of between and within scatters. The density-based method, however, performs well only if a larger number of training data points are available.

Ensemble-Based Method. The idea behind this method is to combine two or more methods to improve the accuracy of the individual methods. The most popular methods are Voting, Stacking, Bagging, and Boosting. This method requires other techniques to be used as base methods. These can be any of the aforementioned approaches, different algorithms, or their variations.

Voting is the simplest technique to decide a final prediction result from multiple voters. The majority of the votes will be chosen as a final decision. Votes are gathered from a collection of classifiers. Stacking is a more advanced form of voting. Instead of taking the majority vote, it uses a meta-learner to justify the best result based on the supervised knowledge. In other words, outputs from a collection of first-level classifiers are fed to a second-level learning algorithm. The meta-learner is trained to optimize the final prediction [START_REF] Sill | Feature-weighted Linear Stacking[END_REF].

Take the research in [START_REF] Goel | Parallel misuse and anomaly detection model[END_REF] as an example. The decision-tree-based classifier and the rule-based classifier are stacked to detect any anomaly from a large network traffic log efficiently. First, the C4.5 decision tree is used to detect known network attack events from all communication traffic. The attack events are classified using C4.5 technique. Meanwhile, the normal traffic is further examined by a CBA classifier, which is trained with normal data. Therefore, the well-known anomaly is quickly filtered out and the unknown log is examined at the second stage using the different classifier.

On the other hand, Bagging and Boosting focus on distribution of the training data. This is because the combination of independent bases can dramatically improve the efficiency of final prediction. Bagging (so-called Bootstrap Aggregating) obtains a data subset for different baselines by using the bootstrap sampling technique [START_REF] Efron | An Introduction to the Bootstrap[END_REF]. The different base classifiers are aggregated using the voting and averaging technique to improve prediction accuracy. Boosting [START_REF] Zhou | Ensemble Methods: Foundations and Algorithms[END_REF] improves the accuracy by building the stronger classifier from an existing weak classifier. Suppose a distribution of data D consists of three parts X1, X2, and X3, and we only have a weak classifier that correctly predicts only X1 and X2. Let the wrong classification X3 be denoted by h1. In order to correct the mistake made by h1, the boosting technique derives a new distribution D J from D. For example, the researcher should focus more on instances in X3 and then train a classifier h2 from D J . Suppose that the new classifier has the correct classification in X1 and X3. We can now combine classifiers h1 and h2 to get a stronger classifier. The process is repeated by adjusting the distribution's parameters until no improvement can be made.

Despite the complexity of incorporating several methods, this technique has been used in a large number of works (e.g., [START_REF] Branisavljević | Improved real-time data anomaly detection using context classification[END_REF], [START_REF] Cruz | A cybersecurity detection framework for supervisory control and data acquisition systems[END_REF], [START_REF] Amir Faisal | Securing advanced metering infrastructure using intrusion detection system with data stream mining[END_REF], [START_REF] Magdalena | Ensemble regression model-based anomaly detection for cyberphysical intrusion detection in smart grids[END_REF], [START_REF] Krishnan | A fusion of multiagent functionalities for effective intrusion detection system[END_REF], [START_REF] Ponomarev | Industrial control system network intrusion detection by telemetry analysis[END_REF], [START_REF] Maglaras | Combining ensemble methods and social network metrics for improving accuracy of OCSVM on intrusion detection in SCADA systems[END_REF], [START_REF] Hamed | Maritime situation analysis framework: Vessel interaction classification and anomaly detection[END_REF]). The algorithms included not only classification-based but also clustering-based techniques. The selected paper in each category is evaluated in Section 5 based on the proposed holistic-analytical evaluation method.

EVALUATION OF SUPERVISED LEARNING APPROACHES FOR SCADA-BASED IDS SYSTEMS

This section provides a detailed review of SCADA-based IDSs in each of the categories presented in 4.2. We describe the paper selection process, followed by the evaluation criteria of each selection. We collected information of proposed solutions with regard to quantity (i.e., the number of publications that used a similar approach) and quality (e.g., benefits, drawbacks and constraints). This information is used to evaluate supervised learning approaches with respect to holistic perspectives from each criterion.

Paper Selection Process

In order to select the relevant and important papers from SCADA-specific IDS research, we followed the literature review protocol illustrated in Figure 9. In step 1, we chose key databases in information technology publications to find papers, namely Association for Computing Machinery (ACM) Digital Library, IEEEXplore (IEE/IEEE), SCOPUS (Elsevier) and Web of Science. Then we defined keywords in three topics to locate potential papers in each database as follows:

SCADA: SCADA, Smart grid, Critical Infrastructure, Industrial Control System, ICS Intrusion detection: Intrusion Detection, IDS, Anomaly Detection Machine Learning technique: Machine learning, ML, classification, classifier

For each database in steps 2 and 3, we searched and selected the papers using the snowball sampling method [START_REF] Biernacki | Snowball sampling: Problems and techniques of chain referral sampling[END_REF], which starts with a small set of highly relevant papers, and then follows its references to build a larger pool of papers to review. The snowball sampling approach was chosen because some important and relevant research might not be indexed by the databases or the search engines that were used. As illustrated earlier in Figure 2, the number of publications on SCADA-specific IDS based on supervised learning solution has risen significantly since 2007, which reflects the renewed and increasing public interest in the protection of critical infrastructure. Hence, we limited the time range from 2007 to present. We formulated search strings suitable for each database based on the keywords above. Next, we ran the queries, assembled the located

Criterion Reasons

Algorithm

Review the most and least popular classification techniques for SCADA-based IDSs studied in the literature with associated benefits, drawbacks, and constraints.

Approach

Compare the literature from the accuracy and flexibility point of view. Although the signature-based method precisely detects attacks, the anomaly-based approach is more flexible in detecting future attacks such as the zero-day exploits.

Architectural properties

The architecture design directly reflects how well it is tailored for systems. To be specific, we examine the system based on scalability, availability, distribution capability, and robustness of the systems.

Auditing sources

Show how far IDS can cover the different types of attacks on the resource constrained environment. Some works detect the anomaly based on the communication behavior only, while others consider the physical state or multiple variables in combination.

Application domain

Indicate the holistic design of the security system that ranges from anomaly detection and supported decision making to investigation support.

Feasibility

Show the distance between simulation and reality. As SCADA is deployed on the critical infrastructure, the simulation and the actual environment are different. Therefore, testing on the real world situation or the SCADA-specific simulator is crucial.

papers, and removed the duplicate papers. The paper abstract and keywords in the located papers were chosen to be related to the three main topics defined above. We then sorted the located papers by main supervised learning algorithms described in Section 4.2.

In step 4, the papers were examined more closely for categorization. Key inclusion criteria were relationship to SCADA security; use of IDS; use of supervised learning to train IDS; quality threshold-clear methodology described; technique implemented and evaluated; and paper published in a journal or conference proceedings that we were able to access the full text. If there were several papers in a particular category, the journal publications were considered with a higher priority compared to conference proceedings. This was because the journals have less restriction on the number of pages and multiple revision cycles, hence they discussed the proposed approaches more comprehensively. The conference papers were also selected based on the relevancy and ranks of the conferences suggested by the Computing Research and Education Association of Australasia (CORE) [START_REF]CORE Conference Portal[END_REF].

Evaluation Criteria

SCADA-specific IDSs differ in their design (i.e., auditing sources and monitoring attacks) and targeted application (i.e., topology and components); therefore, we cannot solely justify the compatibility of IDSs based on the statistical metrics (i.e., accuracy, specificity, sensitivity). For this reason, we have used a qualitative comparison instead.

In order to understand the challenges of SCADA-based IDS with supervised learning techniques, we propose some evaluation criteria to measure the effectiveness and efficiency of the proposed algorithms with respect to the requirements of SCADA-based IDSs discussed in Section 2.4. Table 1 summarizes the key criterion of each measure and the reason behind its selection.

Categories of SCADA-Based IDS Systems

Rule-Based Method. As shown in Table 2, the rule-based technique is one of the most common technique among all categories from the selected set of publications in this survey. With respect to the detection approach (see Table 2 column Approach), more than half of the proposed solutions in the literature use signature-based approach. In most cases, experts are required to establish a set of detection rules, especially, to learn about the known normal/abnormal states associated with SCADA-specific hardware, e.g., IED [START_REF] Kanchana Premaratne | An intrusion detection system for IEC61850 automated substations[END_REF][START_REF] Yang | Rule-based intrusion detection system for SCADA networks[END_REF], Generic Object Oriented Substation Events (GOOSE), Sampled Measured Value (SMV) protocols [START_REF] Yang | Multidimensional intrusion detection system for IEC 61850-based SCADA networks[END_REF], and behavior of automated process [START_REF] Erez | Control variable classification, modeling and anomaly detection in Modbus/TCP SCADA systems[END_REF].

In general, the predefined rules are functions of normal states rather than fixed constants. Take the research in [START_REF] Kanchana Premaratne | An intrusion detection system for IEC61850 automated substations[END_REF] as an example, they define misuse detection rules using multiple alert functions, namely correlation between switching devices, alarms from relay protection function, timerelated constraints of critical control commands, and payload length detector. We observed fewer papers in this group (e.g., Rough Sets Classification [START_REF] Jamei | Micro synchrophasor-based intrusion detection in automated distribution systems: Toward critical infrastructure security[END_REF] and RIPPER [START_REF] Pan | Anomaly based intrusion detection for building automation and control networks[END_REF] techniques) that used automated rules set discovery technique compared to the signature-based approach. Apart from that, special "honey" tokens can also be applied to detect tampers with the communication traffic [START_REF] Kamran | Intrusion detection system using honey token based encrypted pointers to mitigate cyber threats for critical infrastructure networks[END_REF].

Since rule-based method is the easiest technique to understand and customize manually by a human, this technique is suitable for specific environments like building an automation control network (i.e., a fire alarm system) [START_REF] Pan | Anomaly based intrusion detection for building automation and control networks[END_REF], SCADA RTUs [START_REF] Pereira Coutinho | Improving a methodology to extract rules to identify attacks in power system critical infrastructure: New results[END_REF], and micro-phasor measurement units (μPMUs) [START_REF] Jamei | Micro synchrophasor-based intrusion detection in automated distribution systems: Toward critical infrastructure security[END_REF]. These systems require specialists or engineers to define associated rules that describe normal states of the system; therefore, the rule-based technique is more efficient compared to techniques in the other categories. Additionally, the automated detection approaches can also be integrated into the rule-based solution to improve flexibility in detecting unknown malicious incidents.

Ensemble Method. This technique also commonly appears in the literature as ensemble approaches build the classification model by selecting the best result from multiple classifiers. Despite the complexity of this method, a number of works [START_REF] Branisavljević | Improved real-time data anomaly detection using context classification[END_REF][START_REF] Cruz | A cybersecurity detection framework for supervisory control and data acquisition systems[END_REF][START_REF] Amir Faisal | Securing advanced metering infrastructure using intrusion detection system with data stream mining[END_REF][START_REF] Magdalena | Ensemble regression model-based anomaly detection for cyberphysical intrusion detection in smart grids[END_REF][START_REF] Krishnan | A fusion of multiagent functionalities for effective intrusion detection system[END_REF][START_REF] Maglaras | Combining ensemble methods and social network metrics for improving accuracy of OCSVM on intrusion detection in SCADA systems[END_REF][START_REF] Ponomarev | Industrial control system network intrusion detection by telemetry analysis[END_REF][START_REF] Hamed | Maritime situation analysis framework: Vessel interaction classification and anomaly detection[END_REF] have successfully used it to obtain better detection rate accuracy. Apart from accuracy, the ensemble method also has the advantage of prediction models that are robust and resistant to a system failure from the malicious cyber event [START_REF] Ashok | Cyber-physical attack-resilient wide-area monitoring, protection, and control for the power grid[END_REF]. Also, the research [START_REF] Magdalena | Ensemble regression model-based anomaly detection for cyberphysical intrusion detection in smart grids[END_REF] overcomes the insufficient training data issue by combining the result from OCSVM and the k-means clustering technique to increase the detection speed and achieve real-time performance. In [START_REF] Ponomarev | Industrial control system network intrusion detection by telemetry analysis[END_REF], the network telemetry (e.g., packet size and time of arrival) is used instead of the actual network data. Various telemetry features are taken into account. The boosting technique creates a strong classifier out of several weak ones. On the other hand, multi-class classifiers (e.g., HMM and SVM) favor big and small classes differently. Hence, the bagging method can be used to find the most effective classifier for the particular class, which is chosen to give a label to the detecting event [START_REF] Hamed | Maritime situation analysis framework: Vessel interaction classification and anomaly detection[END_REF].

Unary Classifier. In some cases [START_REF] Germano Da Silva | A one-class NIDS for SDN-based SCADA systems[END_REF][START_REF] Maglaras | Intrusion detection in SCADA systems using machine learning techniques[END_REF][START_REF] Nader | Detection of cyberattacks in a water distribution system using machine learning techniques[END_REF][START_REF] Wan | Double behavior characteristics for one-class classification anomaly detection in networked control systems[END_REF], unary classifiers, such as the OCSVM, have outperformed other classification methods in terms of accuracy. Unary classifiers work well when there is only one class of data available. Since there is a lack of datasets containing real SCADA attacks, the OCSVM classifier can be used to train only using the normal data [START_REF] Shen Yin | Fault detection based on a robust one class support vector machine[END_REF]. Hence, OCSVM is more popular than the original SVM, which requires both normal and abnormal training set [START_REF] Germano Da Silva | A one-class NIDS for SDN-based SCADA systems[END_REF]. However, a constraint of unary classifier is that the training dataset must not contain attack instances. It is possible in a real-life scenario that, there could be some 0-day attacks that remain undetected [START_REF] Queiroz | SCADASim-A framework for building SCADA simulations[END_REF].

Probabilistic Method. Probabilistic classifiers are useful to provide an estimate a probability distribution over a set of classes, rather than a single class that the observation should belong to.

Tylman W. [117] NB J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J Zhou C. et
J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J
Lazy learners Silva P. Markovitz M. and Wool A. [START_REF] Markovitz | Field classification, modeling and anomaly detection in unknown CAN bus networks[END_REF] SVM SVM SVM SVM Field Boundary

J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J
J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J J
J J J J J J J J J J J J J Maglaras L. A. et al. [72]
Cruz T. et al. [START_REF] Cruz | A cybersecurity detection framework for supervisory control and data acquisition systems[END_REF] J J J J J J J J J J J J J J Kosek A. M. and Gehrke O. [START_REF] Magdalena | Ensemble regression model-based anomaly detection for cyberphysical intrusion detection in smart grids[END_REF] Sadhasivan D. K. and Balasubramaninan K.

[63]

J J J J J J J J J J J J J J

Benchmarking

Ozgur A. and Erdem H. [START_REF] Özgür | Intrusion detection classifiers comparison in different operating environments[END_REF] Hurst W. et al. [START_REF] Hurst | Big data analysis techniques for cyber-threat detection in critical infrastructures[END_REF] Swetha R. B. S. and Meena K. G. [START_REF] Sri Swetha | Smart grid -A network based intrusion detection system[END_REF] Junejo K. N. and Goh J. [START_REF] Nazir | Behaviour-based attack detection and classification in cyber physical systems using machine learning[END_REF] Onoda T. [START_REF] Onoda | Probabilistic models-based intrusion detection using sequence characteristics in control system communication[END_REF] SVM, NB, DT LDC, UDC, QDC, PARZENC and TREEC DT, K-NN, SVM Multiple HMM,CRF, OCSVM, SVDD, Rule-based

J J J J J J J J J J J J J J J J J J J J J J J J J J
HMM is the most popular option in this group. Although HMM is computationally efficient and flexible to retrain the model when the updated data is available, it cannot capture higher order correlation of the data. This is because of a strict states dependency assumption of HMM. For instance, the same sequence of features could indicate different states depending on different contexts or intentions. This issue is known by researchers [START_REF] Onoda | Probabilistic models-based intrusion detection using sequence characteristics in control system communication[END_REF][START_REF] Zhou | Design and analysis of multimodel-based anomaly intrusion detection systems in industrial process automation[END_REF][START_REF] Zohrevand | Hidden Markov based anomaly detection for water supply systems[END_REF]. A technique like N -gram is used to preserve contextual meaning by grouping N sequence of observations together. Apart from that, multiple independent factors (e.g., Task and resource models, Control data flow models, and Critical state of critical processes) are correlated to increase prediction accuracy and decrease the false alerts.

Other Methods. The remaining techniques proposed in the literature are across various categories of algorithms, such as divide-and-conquer (i.e., [START_REF] Moon | DTB-IDS: An intrusion detection system based on decision tree using behavior analysis for preventing APT attacks[END_REF], [START_REF] Shengyi Pan | Developing a hybrid intrusion detection system using data mining for power systems[END_REF], and [START_REF] Samdarshi | A triple layer intrusion detection system for SCADA security of electric utility[END_REF]) and boundary methods (e.g., SVM [START_REF] Wahyudi Masduki | Study on implementation of machine learning methods combination for improving attacks detection accuracy on Intrusion Detection System (IDS)[END_REF][START_REF] Patel | A nifty collaborative intrusion detection and prevention architecture for smart grid ecosystems[END_REF][START_REF] Patrascu | Cyber protection of critical infrastructures using supervised learning[END_REF][START_REF] Vijayanand | Support vector machine based intrusion detection system with reduced input features for advanced metering infrastructure of smart grid[END_REF] and Field Boundary [START_REF] Markovitz | Field classification, modeling and anomaly detection in unknown CAN bus networks[END_REF]). However, lazy learning (i.e., [START_REF] Silva | On the Use of K-NN in Intrusion Detection for Industrial Control Systems[END_REF] and [START_REF] Tang | A local density-based approach for outlier detection[END_REF]) and density-based (i.e., EM [START_REF] Yoo | Novel approach for detecting network anomalies for substation au-tomation based on IEC 61850[END_REF]) are occasionally used for supervised SCADA IDS. Some constraints have been learned from applying these solutions. For example, the lazy learning method does not scale enough for the large network [START_REF] Silva | On the Use of K-NN in Intrusion Detection for Industrial Control Systems[END_REF] and the density method still lacks accuracy to be used in the real field [START_REF] Yoo | Novel approach for detecting network anomalies for substation au-tomation based on IEC 61850[END_REF].

Approaches Used to Detect Anomalies

Based on the approach column in Table 2, published works are categorized into three types: signature-based, anomaly-based and hybrid.A signature-based solution is specifically designed for a particular system or protocol, as discussed in Section 5.3. Due to the constraint of using the rules, only known attacks, such as MITM attack and ARP cache poisoning, are analyzed to evaluate the detection efficiency [START_REF] Yang | Multiattribute SCADA-specific intrusion detection system for power networks[END_REF]. Even though these tasks require the knowledge in system protocols, operations, and specific characteristic of attacks, it usually offers a low false alarm rate compared to the machine learning solution, hence more practical for industry. Besides, the signature-based method requires a footprint of attacks to be updated regularly and cannot guarantee the new intrusion threats such as zero-day exploits [START_REF] Naser Mahmood | Network Traffic Analysis and SCADA Security[END_REF]. Therefore, we observed that most of the proposed works are anomaly-based detection.

It is hard to keep the detection rules up-to-date as new vulnerability is emerging regularly. The anomaly-based approach focuses on building a model of normal/abnormal behaviors instead of defining rules. In constructing the model, various machine learning algorithms were used (see column Algorithms in Table 2). However, the decision of what algorithm should be used not only depends on characteristic of auditing sources (e.g., network traffic, application usage behavior, or physical state of the actuator; see column Auditing) but also vary by the character of data and constraints of applications. With network traffic dataset from DARPA [START_REF] Shen Yin | Fault detection based on a robust one class support vector machine[END_REF], different algorithms are applied. For instance, Onoda [START_REF] Onoda | Probabilistic models-based intrusion detection using sequence characteristics in control system communication[END_REF] used the HMM algorithm to focus on characteristic of sequential behaviors, whereas SVM is used in [START_REF] Wahyudi Masduki | Study on implementation of machine learning methods combination for improving attacks detection accuracy on Intrusion Detection System (IDS)[END_REF] and [START_REF] Patel | A nifty collaborative intrusion detection and prevention architecture for smart grid ecosystems[END_REF] with selected features of network communication data (considered as a data-point) to build the optimal separation plane between the center of two classes, which is used to distinguish between benign and anomaly incidents. Meanwhile, Sadhasivan and Balasubramaninan [START_REF] Krishnan | A fusion of multiagent functionalities for effective intrusion detection system[END_REF] aim to develop an adaptive IDS, which can update the attack information over time. The proposed work fuses ADA (Anomaly Detection Agent) and RBA (Rule-Based Agent) to detect misuse from the network traffic data. Based on the same dataset, an ensemble technique is considered [START_REF] Amir Faisal | Securing advanced metering infrastructure using intrusion detection system with data stream mining[END_REF] to eliminate noises from the training or testing dataset. With more than one classifier, the boosting technique selects the best prediction results from classifiers, hence accuracy is improved.

The hybrid method combines both the system-specific signature and the behavior-based detection model, for example, a defense-in-depth strategy in [START_REF] Stefanidis | An HMM-based anomaly detection approach for SCADA systems[END_REF]. The IDS system consists of "Header subsystem" and "Data subsystem", where the signature of abnormal Modbus protocol header is defined in the first module and the HMM is used to detect (in depth) attacks from traffic data in the second module. Combination of the signature and behaviors models helps to speed up the detection and highlight the specific type of attacks. Similarly, Distributed Intrusion Detection Sys-tem (DIDS) system in [START_REF] Cruz | A cybersecurity detection framework for supervisory control and data acquisition systems[END_REF] handles known exploitations with signature definition while using the anomaly-based approach to prevent the emerging threats. Despite tight coupling to the system and the complexity of combining two detection systems, the number of hybrid-methods is quite small compared to other approaches.

Architectural Design Properties

The decision between centralized and decentralized architecture is always controversial. On the one hand, the centralized IDS is easy to monitor and make a decision from the central location without limitations of resources; hence, the more complicated detection/classification tasks can be done. On the other hand, the decentralized or distributed IDS architecture is more scalable and resilient compared to the centralized scheme [START_REF] Escamilla | Intrusion Detection: Network Security Beyond the Firewall[END_REF]. According to the requirement of SCADA-IDS in Section 2.4, here, the architectural perspective is discussed based on four (4) key aspects:

(1) scalability of the algorithm, (2) real-time performance, (3) decentralization, and (4) resilience, as follows: Scalability of Algorithm. We have not observed many papers that explicitly state scalability property of their work. For instance, the work in [START_REF] Germano Da Silva | A one-class NIDS for SDN-based SCADA systems[END_REF] proposes the OCSVM-based algorithm, where the sub-model learns heterogeneous normal training sets to detect outliers of the large and diverse system. Apart from that, the cost of maintenance is important for scalability design. Pan et al. [START_REF] Shengyi Pan | Developing a hybrid intrusion detection system using data mining for power systems[END_REF] developed a scalable stateful IDS to prevent temporal attacks. Besides, enlarging the existing complex system is a costly and difficult task. The scalable system helps to save lots of money and time for maintenance tasks. Hence, the hybrid approach was used. First, the signature is used to reduce irrelevant events. Second, the anomaly detection model examines the suspect events more closely. The proposed common path mining algorithm mines data from both the physical (synchrophasor) and the logical (system logs) algorithms to formulate signatures of attacks (common paths). This fusion technique identifies attacks from abnormal states which shared in the common paths.

Real-time performance: this is a crucial property. Based on Table 2: column Architecture, it is clear that most of the literature focuses on real-time detection characteristics to avoid reduction of a system's availability. For instance, the critical infrastructure like railway traffic control. This system needs to be monitored at real-time. In [START_REF] Andrysiak | Network anomaly detection for railway critical infrastructure based on autoregressive fractional integrated moving average[END_REF], the traffic control data gathered from WSN (Wireless Sensor Network) is modeled using ARFIMA (Autoregressive Fractional Integrated Moving Average) technique, which analyzes the deviation between parameters of the network traffic and creates a statistical model for the system. The MLE (Maximum Likelihood Estimation) algorithm is used to detect the anomaly in this control system.

Parallel processing is needed to archive real-time performance. NIDS (Network Intrusion Detection System) in [START_REF] Wan | Double behavior characteristics for one-class classification anomaly detection in networked control systems[END_REF] has been tested on the simulated Modbus/TCP system. Two OCSVM-based algorithms were proposed to analyze both control and process data simultaneously. The detection process consumed less than 27 seconds to detect attacks with a small, medium, and large num-ber of abnormal function control behavior. On the other hand, as parts of the CockpitCI project, the Domain-specific IDS for SCADA ICS (Industrial Control System) [START_REF] Cruz | A cybersecurity detection framework for supervisory control and data acquisition systems[END_REF] focuses on decreasing the false positives of OCSVM by proposing IT-OCSVM algorithm. By running several OCSVMs in parallel, the final outcome is chosen using the mean value method and SNA (Social Network Analysis). They monitored three layers (data-link, network and transport protocols) to detect attacks, e.g., MITM and DoS (Denial of Service).

Decentralization. The design of distributed IDS is arbitrary and specialized for a particular system. For instance, the IDS for AMI (Advanced Metering Infrastructure) in [START_REF] Amir Faisal | Securing advanced metering infrastructure using intrusion detection system with data stream mining[END_REF] distributes IDS modules into three components: Meter-IDS, Data Concentrator-IDS, and Headend-IDS, from a small to a large stream of information, respectively. The IDS filters attacks from the smallest unit (Meter-IDS) to the largest (Headend-IDS) serially. However, the proposed system requires the whole network to be isolated and free from noise (i.e., communication between other devices in the network) to achieve the best detection accuracy; hence, it is suitable for Software Defined Network (SDN) SCADA. On the other hand, the Distributed IDS has been used in [START_REF] Cruz | A cybersecurity detection framework for supervisory control and data acquisition systems[END_REF]. With several IDS distributed through the wide network, they are not only able to identify attacks from different parts of the system but also increase system robustness in case of failure that causes sub-networks to disconnected from the central server. The DIDS breaks the whole network traffic data down to subsets of the disjoint dataset. By using the IT-OCSVM technique and weighting technique (i.e., voting between results from the classifiers to get the best prediction outcome), the proposed DIDS is able to increase detection accuracy while minimizing the rate of false alarms.

From a different angle, da Silva et al. [START_REF] Germano Da Silva | A one-class NIDS for SDN-based SCADA systems[END_REF] points out that the distributed NIDS processes the detection in parallel and is suitable for a large-scale SDN SCADA. The proposed NIDS consists of five (5) components SDN controller, historian server, feature selector, one-class classifier, and NIDS management interface. Each component is responsible for different tasks. For example, the SDN controller monitors anomalous flows in network switches, while the historian server stores snapshots of networks to be able to apply the parallel MapReduce operation. The proposed One-Class Classifier (OCC) works well with a large dataset, it uses only one set of normal network data to detect the DoS attack on Modbus protocol.

Resilience. A formal definition of resilience is the ability of a system to recover from faults and return to its original state or other working states. Interestingly enough, only a limited number of works discussed resiliency of IDS systems. In [START_REF] Patrascu | Cyber protection of critical infrastructures using supervised learning[END_REF], the time-out has been used to discard unresponsive classifier workers. The proposed work integrates game theory and data streaming classifiers (which work in parallel) to heuristically detect various type of attacks. The IDS feeds abnormal events into the game model to determine win conditions between attacker and defender; hence, the IDS can detect the unknown threats by learning for the existing data. The result shows detec-tion accuracy is better than using KNN and decision trees techniques. Another example has not explicitly specified the resilient characteristic in this article. We assume that the distributed IDS with parallel detection components like [START_REF] Amir Faisal | Securing advanced metering infrastructure using intrusion detection system with data stream mining[END_REF] resists failures. Since a number of IDS components are duplicated and work independently, some faulty nodes would not affect the whole system.

Data Sources Used for Anomaly Detection

Several sources of information can be inspected to identify misuse or abnormal events in a SCADA system. Literature in this review is categorized into four (4) groups for auditing data: (1) Network traffic, (2) Physical state, (3) Application usage behavior, and (4) Unification of cyber-physical state. Since most works chose to monitor network traffic, we separate out SCADA specific protocol to check if the IDS uses generic communication features or SCADA specific protocols' features. This is shown in column Auditing in Table 2.

Most network-based IDS solutions were tested with SCADA-specific datasets or a combination of generic and SCADA-specific datasets. In [START_REF] Krishnan | A fusion of multiagent functionalities for effective intrusion detection system[END_REF], both types of communication data are used to train various functionalities detection agents (namely Sniffer Agent, Filter Agent, Rule Mining Agent, Anomaly Detection Agent, and Rule-Based Agent). The proposed multiagents IDS shows a better detection performance on the SCADA-specific dataset [START_REF] Morris | A control system testbed to validate critical infrastructure protection concepts[END_REF] compared to the generic KDD CUP 99 dataset [START_REF] Ashok | Cyber-physical attack-resilient wide-area monitoring, protection, and control for the power grid[END_REF]. Meanwhile, instead of extracting features from contents of packets (e.g., TCP/IP or Modbus), the researchers [START_REF] Ponomarev | Industrial control system network intrusion detection by telemetry analysis[END_REF] make use of telemetry characteristic. By capturing flows of the transmitting packets between clients and servers, they are able to differentiate between PLC machine of attacker and engineer. This approach makes senses when considering contexts of ICS network since nodes are resource-constrained and connected wirelessly. They claimed the accuracy of telemetry technique is closed to other IDS approach yet harder to evade using encryption techniques [START_REF] Ponomarev | Industrial control system network intrusion detection by telemetry analysis[END_REF].

On the other hand, since the SCADA protocol is based on existing Internet standards, some approaches (e.g., [START_REF] Wahyudi Masduki | Study on implementation of machine learning methods combination for improving attacks detection accuracy on Intrusion Detection System (IDS)[END_REF], [START_REF] Onoda | Probabilistic models-based intrusion detection using sequence characteristics in control system communication[END_REF], and [START_REF] Patrascu | Cyber protection of critical infrastructures using supervised learning[END_REF]) used generic traffic data to evaluate the proposed IDS solutions. In [START_REF] Patrascu | Cyber protection of critical infrastructures using supervised learning[END_REF], the pre-recorded pcap dataset, which contains various network attacks, has been used to verify the game-based multi-agents IDS solution. This dataset has also been used in the Capture The Flag contest at DEFCON event. Masduki et al. [START_REF] Wahyudi Masduki | Study on implementation of machine learning methods combination for improving attacks detection accuracy on Intrusion Detection System (IDS)[END_REF] focuses on the particular Remote to Local (R2L) attack. The generic KDD 99 Dataset [START_REF] Ashok | Cyber-physical attack-resilient wide-area monitoring, protection, and control for the power grid[END_REF] has been used to evaluate the detection accuracy. The probabilistic-based IDS in [START_REF] Onoda | Probabilistic models-based intrusion detection using sequence characteristics in control system communication[END_REF] randomly chose 10,000 normal packets from DARPA dataset [START_REF] Shen Yin | Fault detection based on a robust one class support vector machine[END_REF] to train the proposed model, and they selected another 10,000 random normal and unauthorized connection data for testing.

Physical control states data can be complicated to model and to detect misuse incidents. Some researchers [START_REF] Nader | Intrusion detection in SCADA systems using one-class classification[END_REF] gathered datasets from a Gas Pipeline testbed [START_REF] Morris | A control system testbed to validate critical infrastructure protection concepts[END_REF] to develop and test their solution. Various fault injection exploits on the control/sensing signals (e.g., negative pressure value injection, fast change response injection, bust response injection, wave pressure injection, and single packet injection) have been studied. The proposed model was trained by using normal control states, and by properly tuned free parameters for the kernel function (bandwidth of the kernel and the number of eigenvectors), they were able to detect both slow and burst response injection attacks. The IDS solution for water treatment system [START_REF] Nazir | Behaviour-based attack detection and classification in cyber physical systems using machine learning[END_REF] was evaluated by injecting ten [START_REF] Anwar | Vulnerabilities of smart grid state estimation against false data injection attack[END_REF] types of attack into their proposed SWaT testbed. The attack disturbed PLC with fault sensor and actuator signals (e.g., data of inflow/outflow rate or level of water in tanks). In their work, various classic classifiers have been compared in detecting the false signals (e.g., SVM, RF, NB, BRTree, BayesNet, and IBK).

Software-behavior-based IDSs have a less significant number of published works compared to the network-based approach. Moon et al. [START_REF] Moon | DTB-IDS: An intrusion detection system based on decision tree using behavior analysis for preventing APT attacks[END_REF] monitors both software-and network-based behavior. They defined software behavior using sets of API calls. For instance, file copying action is described using API CopyFile, CopyFileA, and MoveFileA, whereas file deletion is defined by calling DeleteFileA and RemoveDirectoryA functions. On the other hand, network behaviors (e.g., excessive network access, changes of packet delivery on ARP/MAC/IP protocols) also been fused with software activities to formulate decision tree for normal and malicious behaviors.

In [START_REF] Wan | Double behavior characteristics for one-class classification anomaly detection in networked control systems[END_REF], the behavior of control functions has been model to detect misuse incident. Although the researcher extracted control commands from SCADA control packets, the detection model only focuses on behavior of software usage (commands issued) instead of network protocol properties. In this case, the models of normal behavior are learned by using numbers of commands issued per minute. In the experiment, they injected 280 malicious and 720 normal commands to the simulated Modbus/TCP system. The OCSVM and RE-KPCA (Reconstruction Error based on Kernel Principal Component Analysis) classifiers are trained and used to classify anomaly in a series of control commands.

The cyber-physical IDS [START_REF] Magdalena | Contextual anomaly detection for cyber-physical security in smart grids based on an artificial neural network model[END_REF] correlates digital data and physical signal to disclose anomaly. Take Distributed Energy Resources (DER) IDS as an example, the proposed IDS detects anomaly based on context. Variables from photovoltaic (PV) and meteorological data (e.g., solar, wind and temperature properties) are aggregated with contextual variable (i.e., timestamp of each measurement). The ANN classifier is used to detect cyber or physical attacks. The research [START_REF] Magdalena | Contextual anomaly detection for cyber-physical security in smart grids based on an artificial neural network model[END_REF] is extended by incorporating with variables of distance between adjacent nodes in [START_REF] Magdalena | Ensemble regression model-based anomaly detection for cyberphysical intrusion detection in smart grids[END_REF]. [134]

KDDCup99

The feature extracted from DARPA raw network data dump.

The dataset based on network communication data has been widely used to test the network intrusion detection system. It originally used for the Data Mining Tools competition.

[15]

NSL-KDD The improve version of KDDCup99

The improved version of KDDCup99 which removes a number of duplicated records.

[16]

A control system testbed to validate critical infrastructure protection concepts TCP/IP data communication in various control system Data is measured from a laboratory-scale gas pipeline, a laboratory-scale water tower, and a laboratory-scale electric transmission system. It is a pre-processed network transaction from 100,000 to 5,000,000 records.

[80]

AIS dataset Marine vessel movement characteristics

The kinematic and non-kinematic vessel characteristics dataset is a location-based marine movements information collected by U.S. The states are collected from the physical state of sensors and actuators every second for 28,800 records in total. The state can be used to analyze the effects of cyber-attacks on the physical states.

[57]

Water supply system dataset Water supply control system status It contains log files of multiple features such as inflow, outflow, water level, temperature, and running status of water stations. The data was collected from 2011 to 2014 at city of Surrey in BC, Canada.

[141]

BOCISS dataset Physical state of control system Physical state of critical control system is simulated from the Siemens Tecnomatix Plant Simulator.

[52]

Furthermore, the holistically monitoring solution in [START_REF] Yang | Multidimensional intrusion detection system for IEC 61850-based SCADA networks[END_REF] combined knowledge from three (3) sources: (1) physical states, e,g., critical switching signal correlation and key analog signal comparison, (2) protocol specifications, e.g., parameters from Generic Object Oriented Substation (GOOSE) and Simple Measure value (SMV) protocols, and (3) behaviors, such as, Substation Configuration Description (SCD) files and IEC 61850 packet contents. The research [START_REF] Yang | Multidimensional intrusion detection system for IEC 61850-based SCADA networks[END_REF] aims to detect exploits from malware, namely Havex and Stuxnet. Table 3 summarizes available datasets referred to by literature in this survey. Various data types are included, namely network traffic, location, physical states, sensors/actuator logs, and states of control devices.

The Feasibility of the Proposed Work

Table 2 column Application compares coverage of IDS design from perspective of security suited, i.e., Security Information and Event Management (SIEM) tools [START_REF] Agrawal | A study on critical capabilities for security information and event management[END_REF][START_REF] Sekharan | Profiling SIEM tools and correlation engines for security analytics[END_REF]. Despite system's avail-ability being crucial, only a few researchers included information about their decision support strategies to help system administrator preventing the system from being attacked [START_REF] Queiroz | A probabilistic model to predict the survivability of SCADA systems[END_REF]. Most of the work offers only feature detection in their design.

On the other hand, from aspect of practicality, researchers used various techniques to verify feasibility to deploy the system in the reality range from simulation to physical testbed. Indeed, the simulated software could lack fidelity, especially the physical signal, which is hard to simulate the actual signal from different hardware devices [START_REF] Holm | A survey of industrial control system testbeds[END_REF]. However, the physical testbed does not scale enough to verify the system, as the physical testbed scale down the real control system. According to Table 2 column feasibility, only four (4) out of fifty [START_REF] Holm | A survey of industrial control system testbeds[END_REF] approaches have deployed in the field [START_REF] Andrysiak | Network anomaly detection for railway critical infrastructure based on autoregressive fractional integrated moving average[END_REF][START_REF] Markovitz | Field classification, modeling and anomaly detection in unknown CAN bus networks[END_REF][START_REF] Hamed | Maritime situation analysis framework: Vessel interaction classification and anomaly detection[END_REF][START_REF] Yasakethu | Intelligent risk detection and analysis tools for critical infrastructure protection[END_REF]. Twelve [START_REF] Anwar | Modeling and performance evaluation of stealthy false data injection attacks on smart grid in the presence of corrupted measurements[END_REF] papers are tested on SCADA-specific testbed or implemented as a testing prototype, whereas the rest are evaluated using various machine learning framework (e.g., MATLAB [START_REF] Shitharth | An enhanced optimization based algorithm for intrusion detection in SCADA network[END_REF], WEKA [START_REF] Samdarshi | A triple layer intrusion detection system for SCADA security of electric utility[END_REF], ACCORD [START_REF] Stefanidis | An HMM-based anomaly detection approach for SCADA systems[END_REF]) or a generic network simulator (e.g., hardware in the loop testbed [START_REF] Shengyi Pan | Developing a hybrid intrusion detection system using data mining for power systems[END_REF]).

Table 4 lists available testbeds that were used by the literature surveyed in this review including both physical and simulated testbed. As referred to by the papers in this survey, the evaluation testbed includes both SCADA-specific and general-purpose systems.

KEY OPEN PROBLEMS

This section presents key research gaps and future research directions of SCADA-based IDSs that use supervised machine learning approaches.

Testbeds and test datasets need further research and development: since it is not practical to train and evaluate a supervised IDS system on a real SCADA system, testbeds and test datasets are crucial for developing a security solution. However, SCADA is widely applied on various control systems, and each of them has the different constraints (e.g., power/water/gas distribution system, manufacturing processes, or railway control system). This makes the construction of high fidelity testbeds costly. Furthermore, some of them are unable to reuse in different contexts of applications. We found that some testbed solutions/datasets in Tables 3 and4 are either for the general IT system (e.g., [START_REF] Ashok | Cyber-physical attack-resilient wide-area monitoring, protection, and control for the power grid[END_REF], [START_REF] Ashok | Testbed-based performance evaluation of Attack Resilient Control for AGC[END_REF], [START_REF] Cézar | The Accord .NET Framework[END_REF], and [START_REF] Shen Yin | Fault detection based on a robust one class support vector machine[END_REF]) or are too specific (such as [START_REF] Nazir | Behaviour-based attack detection and classification in cyber physical systems using machine learning[END_REF] and [START_REF] Coast | Automatic identification system overview[END_REF]). Thus, the fidelity can be low compared to the real-world system or not reliable to be used with different settings and scale. With respect to the development cost, the direction of research should focus on developing a high-fidelity simulation testbed and not the more expensive hardware-based solution.

Resilience and Validation of the Security Design

Have not Yet Been Sufficiently Explored. Since SCADA is designed for critical control systems, system availability is crucial. Although several articles focused on real-time performance in detecting threats and scalability of the system, resilience -which allows the recovery of the security system after the faults (e.g., attacks or natural disaster) to its original or useful state-is often ignored. Besides, most of the research detects anomalies solely based on network traffic from a single source only. Thus, a single point of failure could easily stop the whole security system. For distributed solutions-SCADA DIDS, e.g., [START_REF] Andrysiak | Network anomaly detection for railway critical infrastructure based on autoregressive fractional integrated moving average[END_REF], [START_REF] Cruz | A cybersecurity detection framework for supervisory control and data acquisition systems[END_REF], [START_REF] Germano Da Silva | A one-class NIDS for SDN-based SCADA systems[END_REF], [START_REF] Amir Faisal | Securing advanced metering infrastructure using intrusion detection system with data stream mining[END_REF], [START_REF] Magdalena | Ensemble regression model-based anomaly detection for cyberphysical intrusion detection in smart grids[END_REF], [START_REF] Krishnan | A fusion of multiagent functionalities for effective intrusion detection system[END_REF], [START_REF] Maglaras | Combining ensemble methods and social network metrics for improving accuracy of OCSVM on intrusion detection in SCADA systems[END_REF], [START_REF] Patrascu | Cyber protection of critical infrastructures using supervised learning[END_REF], [START_REF] Sri Swetha | Smart grid -A network based intrusion detection system[END_REF], [START_REF] Yang | Multiattribute SCADA-specific intrusion detection system for power networks[END_REF], and [START_REF] Zohrevand | Hidden Markov based anomaly detection for water supply systems[END_REF], the validation of security and system resilience is a complex task. The formal method, which is used to design the critical system, could also be used to verify the security system (e.g., using the recovery model [START_REF] Babin | A system substitution mechanism for hybrid systems in Event-B[END_REF]) and further develop an optimization solution from security and resilience perspectives.

Prevention and Investigation

Are not Yet Well Studied. Although the proposed IDS solutions serve as parts of an overall security system, an active SCADA system should rely on a more holistic solution. Some of the research work [56, 63, 69, 91-93, 95, 132, 133, 135, 138, 141] covers both detection and prevention by including automatic critical incident response. However, there is only one work [START_REF] Patel | A nifty collaborative intrusion detection and prevention architecture for smart grid ecosystems[END_REF] that includes forensic solution in the selected literature, which helps to record and reconstruct the attack event to identify system vulnerability. It is still an open question, how to incorporate these three areas of security measures to deliver the resilience and robustness to the SCADA system.

Distributed IDS Collaboration for the SCADA System Is Still in an Early Age of Development. The DIDS collaborates multiple IDSs to enable scalability to the large network as well as mitigating with the massive parallel attacks. The research [START_REF] Chen | Malware characteristics and threats on the internet ecosystem[END_REF][START_REF] Friedberg | Combating advanced persistent threats: From network event correlation to incident detection[END_REF] shows that aggregation and correlation between various data sources have potential to detect distributions of malware or exploit. However, the more challenging problem of collaborative IDS is how can the distributed network of IDSs share their knowledge and efficiently improve the detection efficiency. The result from the new research [START_REF] Xie | Fast and peer-to-peer vital signal learning system for cloud-based healthcare[END_REF] illustrates a potential of improving DIDS efficiency by introducing a distributed learning model. That is, multiple learners (or IDSs) share information about malicious events to improve their own detection models. However, this is still in an early stage of the work of the distributed learners and needs further study.

CONCLUSIONS

This survey article looked at emerging research into the application of supervised-learning-based approaches to implementing SCADA-based IDS systems. We have reviewed the development of such systems from research and industry perspectives and provided a comprehensive study of supervised-learning approaches for SCADA-based IDS systems using specific criteria and properties. We have discussed additional issues and challenges for SCADA-based IDS systems using supervised-learning techniques and illustrated the trends to develop such systems.

To identify the future directions in developing new algorithms and to guide the selection of algorithms for SCADA-based IDS systems, we propose a categorizing framework to classify a number of supervised-learning algorithms. This framework is designed from a theoretical viewpoint both to evaluate IDSs of SCADA systems on supervised learning as well to theoretically analyze the most representative supervised machine learning algorithm for SCADA-based IDS systems. Thus, even future SCADA-based IDS systems could be incorporated into the framework according to the proposed criteria and properties. In future work, we will focus on the unsupervised learning algorithms and feature selection for SCADA-based IDS systems.

Fig. 2 .

 2 Fig. 2. Evolution of IDS schemes based on machine learning approaches (between 2007-2018 and ongoing).

Fig. 3 .

 3 Fig. 3. The first generation of SCADA architecture.

Fig. 4 .

 4 Fig. 4. The second generation of SCADA architecture.

Fig. 5 .

 5 Fig. 5. The third generation of SCADA architecture.

Fig. 6 .

 6 Fig. 6. A taxonomy of IDSs for SCADA systems.

Fig. 7 .

 7 Fig. 7. The process of the supervised learning-based IDS approach.

Fig. 8 .

 8 Fig. 8. Categories of classification algorithms used in SCADA-based IDSs.

  selects the most effective rules that identify a class of each tuple from the training set. The CBA algorithm learns a Class Association Rule (CAR) from the training set D, defined as xi Ci , where the feature xi implies a class Ci . The rule holds support sup% = xi / D and confident conf % = xi Ci / D , where xi depicts total number of tuples with the attribute xi , xi Ci means total number of attribute value xi that implies the class value Ci , and D denotes total number of tuples in the training set. These are minimum thresholds (i.e.

Fig. 9 .

 9 Fig. 9. Paper Selection Process.

  W. et al.[START_REF] Wahyudi Masduki | Study on implementation of machine learning methods combination for improving attacks detection accuracy on Intrusion Detection System (IDS)[END_REF] Patrascu A. and Patriciu V.[START_REF] Patrascu | Cyber protection of critical infrastructures using supervised learning[END_REF] Vijayanand R. et al.[START_REF] Vijayanand | Support vector machine based intrusion detection system with reduced input features for advanced metering infrastructure of smart grid[END_REF] Patel A. et al.[START_REF] Patel | A nifty collaborative intrusion detection and prevention architecture for smart grid ecosystems[END_REF]

Table 1 .

 1 Evaluation Criteria for SCADA-Based IDSs

Table 2 .

 2 Comparison of Methods for SCADA-Based IDS Groups by Classification Techniques

				Approach Architecture	Auditing	Application	Feasibility
	Category	Authors	Algorithms	Signature-based Anomaly-based Hybrid approach	Scalable Real time detection Decentralized/distributed Resilient	Network traffic SCADA speciftc protocol Application behavior Physical state Unifted cyber-physical	Detection Prevention	Investigation	Simulation/testbed SCADA-

testbed Prototype Real-world deployment Open source Portable

Table 3 .

 3 Description of Dataset

	Dataset	Data Type	Description	Reference
	DARPA	Raw TCP/IP dump	The dataset published by Defense Advanced
		files	Research Projects Agency (DARPA) initiative for
			evaluation of network-based intrusion detection
			system.

  Coast Guard Services. The example of features is latitude, longitude, ground speed, course over ground, rate of turn, and vessel type.

		[118]
	Behavior-Based Attack	Physical state of
	Detection and	sensors and
	Classification in Cyber	actuators.
	Physical Systems Using
	Machine Learning

Table 4 .

 4 Description of Testbed Simulated The testbed consists of SCADA nodes (e.g., HMI, historian, IED), protocols (i.e., IEC 60870-5-103) and malicious host to simulate attacks incident, such as MITM attacks. However, details of the software used in the simulate is undisclosed for security purposes.

	Name	SCADA-Speciftc? Approach	Description	Reference
	Fire Alarm	Y	Physical	Building Automation and Control (BAC)	[91]
	System testbed			networks or BACnet testbed simulate the
				operation of fire alarm system using BACnet
				protocol monitoring module
	SCADA testbed	Y	Physical	It simulates a small SCADA system which	[72]
				composed of Human-Machine Interface (HMI)
				Station, managed switch and two PLCs. This can
				be used to simulate the network attack such as
				TCP port scanning, ARP cache spoofing and
				denial of service attack.
	CSIT SCADA	Y			[131]
	IDS
	Gas pipeline	Y	Physical	This testbed simulates typical SCADA control	[81]
	testbed			units, namely Master Terminal Unit (MTU),
				Remote Terminal Units (RTU) and Human
				Machine Interface (HMI).
	Secure Water	Y	Simulated This testbed scales down water treatment system.	[57]
	Treatment			It is designed to develop a security solution for
	(SWaT)			Cyber Physical System (CPS), such as water
				treatment, electric power generation and
				distribution. It is composed of networking layers,
				PLCs, HMIs, SCADA workstation and Historian
				unit.
	SCADAsim	Y	Simulated Based on OMNET++, it emulates the network	[97]
				communication of simulated and real devices to
				analyze the impact of attacks on the devices on
				SCADA network.
	Cyber-physical	Y	Simulated This is based on Cyber-physical build for IEC	[129]
	test-bed			61850 based smart substations. The testbed
				consists of six (6) layers from simulation to
				substation layer. It supports a number of
				network-based attacks, such as malformed packet,
				MITM, address resolution protocol (ARP)
				spoofing.
	Accord	N	Simulated Accord provides a well-tested and documented	[110]
	Framework			library for constructing various types of
				algorithms
	CONPOT	Y	Simulated It can be used to simulate the network of	[98]
	ICS/SCADA			programmable logic controllers (PLC) units to
	Honeypot			analyze network telemetry of honeypots and the
				packages generated by intruders.