{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,2]],"date-time":"2026-05-02T06:38:10Z","timestamp":1777703890515,"version":"3.51.4"},"reference-count":37,"publisher":"SAGE Publications","issue":"2","license":[{"start":{"date-parts":[[2018,7,5]],"date-time":"2018-07-05T00:00:00Z","timestamp":1530748800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["Journal of Intelligent &amp; Fuzzy Systems"],"published-print":{"date-parts":[[2018,8,26]]},"abstract":"<jats:p>Owing to its integration with cyber, Industrial Internet of Things (IIoT) is susceptible to integrity attacks, thereby inflicting fatal consequences both in industrial and economic domains. Compared to traditional networks, IIoT based on Software Defined Network (SDN) provides various network security enhancements thereby decreasing the effects of the integrity attacks. In an industrial process, anomaly detection with negligible false positives is the ideal intrusion detection mode, where the prerequisite of storing the attack patterns or acquiring the exhaustive knowledge of the devices in IIoT is not required. This research is an extension of our previous work, which employed a hybrid of specification and anomaly detection methods to recognize anomalies of critical components from a water treatment test bed at the Singapore University of Technology and Design (SUTD). The proposed work defines invariants for all the processes of the test bed. Any conflict from the invariants is notified as an intrusion and the compromised device is identified. The validation is done through Mininet tool with the testbed dataset. Out of the 30 successful attacks, this effort discovers 29 attacks with the detection rate of 96.5% and false positive rate of 6.5%.<\/jats:p>","DOI":"10.3233\/jifs-169670","type":"journal-article","created":{"date-parts":[[2018,7,6]],"date-time":"2018-07-06T12:08:58Z","timestamp":1530878938000},"page":"1267-1279","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":11,"title":["Employing invariants for anomaly detection in software defined networking based industrial internet of things"],"prefix":"10.1177","volume":"35","author":[{"given":"Surendar","family":"Madhawa","sequence":"first","affiliation":[{"name":"School of Computing, SASTRA University, Thirumalaisamudram, Thanjavur, Tamilnadu, India"}]},{"given":"P.","family":"Balakrishnan","sequence":"additional","affiliation":[{"name":"SCOPE, VIT University, Vellore, Tamilnadu, India"}]},{"given":"Umamakeswari","family":"Arumugam","sequence":"additional","affiliation":[{"name":"School of Computing, SASTRA University, Thirumalaisamudram, Thanjavur, Tamilnadu, India"}]}],"member":"179","published-online":{"date-parts":[[2018,7,5]]},"reference":[{"key":"e_1_3_2_2_2","first-page":"800","article-title":"Guide to Industrial Control Systems (ICS) security","author":"Stouffer K.","year":"2015","unstructured":"K.Stouffer, V.Pillitteri, S.Lightman, M.Abrams and A.Hahn, Guide to Industrial Control Systems (ICS) security, NIST Special Publication800-82, (2015).","journal-title":"NIST Special Publication"},{"key":"e_1_3_2_3_2","first-page":"1","article-title":"Detecting cyber-physical attacks in Cyber Manufacturing systems with machine learning methods","author":"Wu M.","year":"2017","unstructured":"M.Wu, Z.Song and Y.B.Moon, Detecting cyber-physical attacks in Cyber Manufacturing systems with machine learning methods, Journal of Intelligent Manufacturing (2017), 1\u201313,","journal-title":"Journal of Intelligent Manufacturing"},{"key":"e_1_3_2_4_2","unstructured":"Framework for Cyber-Physical Systems: Volume 2 Working Group Reports2 (2017)."},{"key":"e_1_3_2_5_2","first-page":"1","author":"ONF","year":"2014","unstructured":"ONF, OpenFlow switch specification, (2014), 1\u2013277.","journal-title":"OpenFlow switch specification"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2014.2371999"},{"issue":"6","key":"e_1_3_2_7_2","first-page":"409","volume":"115","author":"Surendar M.","year":"2017","unstructured":"M.Surendar, P.Balakrishnan and A.Umamakeswari, Framework for Anomaly Detection In Industrial Internet of Things Driven by Software Defined Networking115(6) (2017), 409\u2013412.","journal-title":"Framework for Anomaly Detection In Industrial Internet of Things Driven by Software Defined Networking"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/2542049"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2016.2566669"},{"key":"e_1_3_2_10_2","article-title":"Data driven intrusion detection in industrial internet of things with software defined networking","author":"Surendar M.","unstructured":"M.Surendar, P.Balakrishnan and A.Umamakeswari, Data driven intrusion detection in industrial internet of things with software defined networking, Journal of Intelligent & Fuzzy Systems[Accepted for publication].","journal-title":"Journal of Intelligent & Fuzzy Systems"},{"key":"e_1_3_2_11_2","unstructured":"Mininet: An instant virtual network on your laptop (or other PC) \u2013 Mininet [Online]. Available: . [Accessed: 10-Sep-2017]."},{"key":"e_1_3_2_12_2","article-title":"A dataset to support research in the design of secure water treatment systems","author":"Goh J.","year":"2016","unstructured":"J.Goh, S.Adepu, K.N.Junejo and A.Mathur, A dataset to support research in the design of secure water treatment systems, Proceedings of the 11th International Conference on Critical Information Infrastructures Security (2016).","journal-title":"Proceedings of the 11th International Conference on Critical Information Infrastructures Security"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSG.2013.2258948"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSMC.2013.2265083"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2014.2312327"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/TPWRD.2014.2300099"},{"key":"e_1_3_2_17_2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1155\/2014\/597697","article-title":"Whitelists based multiple filtering techniques in SCADA sensor networks","author":"Kang D.","year":"2014","unstructured":"D.Kang, B.Kim, J.Na and K.Jhang, Whitelists based multiple filtering techniques in SCADA sensor networks, Journal of Applied Mathematics (2014), 1\u20137.","journal-title":"Journal of Applied Mathematics"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2016.01.001"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2014.2367322"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2016.04.006"},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2015.2512522"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSMC.2015.2415763"},{"key":"e_1_3_2_23_2","first-page":"141","article-title":"An investigation into the response of a water treatment system to cyber attacks","author":"Adepu S.","year":"2016","unstructured":"S.Adepu and A.Mathur, An investigation into the response of a water treatment system to cyber attacks, Proceedings of the 17th IEEE International Symposium on High Assurance Systems Engineering (HASE) (2016), 141\u2013148.","journal-title":"Proceedings of the 17th IEEE International Symposium on High Assurance Systems Engineering (HASE)"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.04.012"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/MDAT.2017.2682223"},{"key":"e_1_3_2_26_2","first-page":"91","volume":"471","author":"Adepu S.","year":"2016","unstructured":"S.Adepu and A.Mathur, Using process invariants to detect cyber attacks on a water treatment system, 471 (2016), 91\u2013104.","journal-title":"Using process invariants to detect cyber attacks on a water treatment system"},{"key":"e_1_3_2_27_2","unstructured":"Dataset & Models - iTrust. [Online]. Available: [Accessed: 31-Oct-2017]."},{"key":"e_1_3_2_28_2","article-title":"A sophisticated packet forwarding scheme with deep packet inspection in an openflow switch","author":"Cho C.H.","year":"2016","unstructured":"C.H.Cho, J.B.Lee, E.Do Kim and J.D.Ryoo, A sophisticated packet forwarding scheme with deep packet inspection in an openflow switch, Proceedings of the 1st International Conference on Software Networking (ICSN) (2016).","journal-title":"Proceedings of the 1st International Conference on Software Networking (ICSN)"},{"key":"e_1_3_2_29_2","first-page":"17","article-title":"Internet traffic classification based on flows\u2019 statistical properties with machine learning","author":"Vladutu A.","year":"2016","unstructured":"A.Vladutu, D.Comaneci and C.Dobre, Internet traffic classification based on flows\u2019 statistical properties with machine learning, International Journal of Network Management (2016), 17\u201331.","journal-title":"International Journal of Network Management"},{"key":"e_1_3_2_30_2","first-page":"752","article-title":"Efficient tuning methodologies for a network payload anomaly inspection scheme","author":"Edmonds W.","year":"2016","unstructured":"W.Edmonds, E.Kim, Sun-il, MacIntyre, C.Karuppanchetty and N.Nwanze, Efficient tuning methodologies for a network payload anomaly inspection scheme, Proceedings of the 13 th IEEE Annual Consumer Communications and Networking Conference (CCNC) (2016), 752\u2013758.","journal-title":"Proceedings of the 13 th IEEE Annual Consumer Communications and Networking Conference (CCNC)"},{"key":"e_1_3_2_31_2","first-page":"808","article-title":"Network packet filtering and deep packet inspection hybrid mechanism for IDS early packet matching","author":"Trabelsi Z.","year":"2016","unstructured":"Z.Trabelsi, S.Zeidan and M.M.Masud, Network packet filtering and deep packet inspection hybrid mechanism for IDS early packet matching, Proceedings of the 30th International Conference on Advanced Information Networking and Applications, (AINA) (2016), 808\u2013815.","journal-title":"Proceedings of the 30th International Conference on Advanced Information Networking and Applications, (AINA)"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2015.7263373"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICPADS.2015.107"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.1007\/s12652-015-0290-y"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2015.05.005"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/2808705.2808715"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2015.2480421"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2453114"}],"container-title":["Journal of Intelligent &amp; Fuzzy Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JIFS-169670","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/full-xml\/10.3233\/JIFS-169670","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JIFS-169670","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T09:39:54Z","timestamp":1777455594000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/10.3233\/JIFS-169670"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,7,5]]},"references-count":37,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2018,8,26]]}},"alternative-id":["10.3233\/JIFS-169670"],"URL":"https:\/\/doi.org\/10.3233\/jifs-169670","relation":{},"ISSN":["1064-1246","1875-8967"],"issn-type":[{"value":"1064-1246","type":"print"},{"value":"1875-8967","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,7,5]]}}}