{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T03:39:06Z","timestamp":1782877146065,"version":"3.54.5"},"publisher-location":"Cham","reference-count":18,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030223113","type":"print"},{"value":"9783030223120","type":"electronic"}],"license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019]]},"DOI":"10.1007\/978-3-030-22312-0_3","type":"book-chapter","created":{"date-parts":[[2019,6,16]],"date-time":"2019-06-16T23:02:48Z","timestamp":1560726168000},"page":"33-48","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":48,"title":["Control Logic Injection Attacks on Industrial Control Systems"],"prefix":"10.1007","author":[{"given":"Hyunguk","family":"Yoo","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Irfan","family":"Ahmed","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2019,6,5]]},"reference":[{"key":"3_CR1","unstructured":"ICS-CERT Annual Vulnerability Coordination Report. Report, National Cybersecurity and Communications Integration Center (2016)"},{"key":"3_CR2","unstructured":"ICS-CERT Advisory on Modicon M221 (ICSA-18-240-01) (2018). https:\/\/ics-cert.us-cert.gov\/advisories\/ICSA-18-240-01. Accessed 15 Dec 2018"},{"key":"3_CR3","unstructured":"Quickdraw Snort - modicon.rules (2018). https:\/\/github.com\/digitalbond\/Quickdraw-Snort\/blob\/master\/modicon.rules. Accessed 15 Dec 2018"},{"key":"3_CR4","doi-asserted-by":"crossref","unstructured":"Abbasi, A., Holz, T., Zambon, E., Etalle, S.: ECFI: asynchronous control flow integrity for programmable logic controllers. In: Annual Computer Security Applications Conference (ACSAC) (2017)","DOI":"10.1145\/3134600.3134618"},{"issue":"12","key":"3_CR5","doi-asserted-by":"publisher","first-page":"44","DOI":"10.1109\/MC.2012.325","volume":"45","author":"I Ahmed","year":"2012","unstructured":"Ahmed, I., Obermeier, S., Naedele, M., Richard III, G.G.: SCADA systems: challenges for forensic investigators. Computer 45(12), 44\u201351 (2012). https:\/\/doi.org\/10.1109\/MC.2012.325","journal-title":"Computer"},{"issue":"6","key":"3_CR6","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1109\/MSP.2017.4251102","volume":"15","author":"I Ahmed","year":"2017","unstructured":"Ahmed, I., Obermeier, S., Sudhakaran, S., Roussev, V.: Programmable logic controller forensics. IEEE Secur. Priv. 15(6), 18\u201324 (2017). https:\/\/doi.org\/10.1109\/MSP.2017.4251102","journal-title":"IEEE Secur. Priv."},{"key":"3_CR7","doi-asserted-by":"publisher","unstructured":"Ahmed, I., Roussev, V., Johnson, W., Senthivel, S., Sudhakaran, S.: A SCADA system testbed for cybersecurity and forensic research and pedagogy. In: Proceedings of the 2nd Annual Industrial Control System Security Workshop, ICSS, pp. 1\u20139. ACM, New York (2016). https:\/\/doi.org\/10.1145\/3018981.3018984","DOI":"10.1145\/3018981.3018984"},{"key":"3_CR8","doi-asserted-by":"crossref","unstructured":"Clements, A.A., et al.: Protecting bare-metal embedded systems with privilege overlays. In: 2017 IEEE Symposium on Security and Privacy (SP) (2017)","DOI":"10.1109\/SP.2017.37"},{"key":"3_CR9","unstructured":"Falliere, N., Murchu, L.O., Chien, E.: W32.Stuxnet dossier. White paper, Symantec Corp., Security Response 5(6), 29 (2011)"},{"key":"3_CR10","doi-asserted-by":"crossref","unstructured":"Garcia, L., Brasser, F., Cintuglu, M.H., Sadeghi, A.R., Mohammed, O., Zonouz, S.A.: Hey, my malware knows physics! Attacking PLCs with physical model aware rootkit. In: Network and Distributed System Security Symposium (NDSS) (2017)","DOI":"10.14722\/ndss.2017.23313"},{"key":"3_CR11","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"354","DOI":"10.1007\/978-3-642-33338-5_18","volume-title":"Research in Attacks, Intrusions, and Defenses","author":"D Had\u017eiosmanovi\u0107","year":"2012","unstructured":"Had\u017eiosmanovi\u0107, D., Simionato, L., Bolzoni, D., Zambon, E., Etalle, S.: N-gram against the machine: on the feasibility of the N-gram network analysis for binary protocols. In: Balzarotti, D., Stolfo, S.J., Cova, M. (eds.) RAID 2012. LNCS, vol. 7462, pp. 354\u2013373. Springer, Heidelberg (2012). https:\/\/doi.org\/10.1007\/978-3-642-33338-5_18"},{"key":"3_CR12","doi-asserted-by":"crossref","unstructured":"Kalle, S., Ameen, N., Yoo, H., Ahmed, I.: CLIK on PLCs! Attacking control logic with decompilation and virtual PLC. In: Binary Analysis Research (BAR) Workshop, Network and Distributed System Security Symposium (NDSS) (2019)","DOI":"10.14722\/bar.2019.23074"},{"key":"3_CR13","doi-asserted-by":"crossref","unstructured":"McLaughlin, S.E., Zonouz, S.A., Pohly, D.J., McDaniel, P.D.: A trusted safety verifier for process controller code. In: Network and Distributed System Security Symposium (NDSS) (2014)","DOI":"10.14722\/ndss.2014.23043"},{"key":"3_CR14","doi-asserted-by":"crossref","unstructured":"Peterson, D.: Quickdraw: generating security log events for legacy SCADA and control system devices. In: IEEE Conference For Homeland Security (2009)","DOI":"10.1109\/CATCH.2009.33"},{"key":"3_CR15","doi-asserted-by":"publisher","first-page":"S57","DOI":"10.1016\/j.diin.2017.06.012","volume":"22","author":"S Senthivel","year":"2017","unstructured":"Senthivel, S., Ahmed, I., Roussev, V.: SCADA network forensics of the PCCC protocol. Digit. Invest. 22, S57\u2013S65 (2017)","journal-title":"Digit. Invest."},{"key":"3_CR16","doi-asserted-by":"crossref","unstructured":"Senthivel, S., Dhungana, S., Yoo, H., Ahmed, I., Roussev, V.: Denial of engineering operations attacks in industrial control systems. In: ACM Conference on Data and Application Security and Privacy (CODASPY) (2018)","DOI":"10.1145\/3176258.3176319"},{"key":"3_CR17","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"226","DOI":"10.1007\/11856214_12","volume-title":"Recent Advances in Intrusion Detection","author":"K Wang","year":"2006","unstructured":"Wang, K., Parekh, J.J., Stolfo, S.J.: Anagram: a content anomaly detector resistant to mimicry attack. In: Zamboni, D., Kruegel, C. (eds.) RAID 2006. LNCS, vol. 4219, pp. 226\u2013248. Springer, Heidelberg (2006). https:\/\/doi.org\/10.1007\/11856214_12"},{"key":"3_CR18","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"203","DOI":"10.1007\/978-3-540-30143-1_11","volume-title":"Recent Advances in Intrusion Detection","author":"K Wang","year":"2004","unstructured":"Wang, K., Stolfo, S.J.: Anomalous payload-based network intrusion detection. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol. 3224, pp. 203\u2013222. Springer, Heidelberg (2004). https:\/\/doi.org\/10.1007\/978-3-540-30143-1_11"}],"container-title":["IFIP Advances in Information and Communication Technology","ICT Systems Security and Privacy Protection"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-22312-0_3","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,12]],"date-time":"2024-03-12T15:33:53Z","timestamp":1710257633000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-030-22312-0_3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019]]},"ISBN":["9783030223113","9783030223120"],"references-count":18,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-22312-0_3","relation":{},"ISSN":["1868-4238","1868-422X"],"issn-type":[{"value":"1868-4238","type":"print"},{"value":"1868-422X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019]]},"assertion":[{"value":"5 June 2019","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"SEC","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"IFIP International Conference on ICT Systems Security and Privacy Protection","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Lisbon","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Portugal","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2019","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"25 June 2019","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27 June 2019","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"34","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"sec2019","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/www.ifipsec.org\/2019\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"76","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"26","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"34% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"This content has been made available to all.","name":"free","label":"Free to read"}]}}