Poster: Towards Selecting Threat Appropriate Industrial Intrusion Detection Systems

A counter-threat intelligence sharing mechanism for dynamic detector selection in industrial control systems

Stefan Lenz; Johannes Weidmann; Martin Henze· 2026· DOI 10.48550/arXiv.2609.12646

The core problem

Industrial control systems (ICS) face a dynamic and evolving threat landscape. Effective security demands detection strategies that can react in a timely manner to changing threat situations. However, static deployment of intrusion detection systems (IDS) may not suffice when attack scenarios vary. The authors propose a counter-threat intelligence sharing based mechanism to select appropriate detectors for current circumstances. This digest summarizes the poster's motivation, approach, evaluation, and implications.

The attack-level performance evaluations show variance in intrusion detection performance depending on the attack scenario. This indicates that no single IDS is optimal across all threats. The results emphasize the benefits of a mechanism that can select appropriate detectors for current circumstances. While specific performance metrics are not detailed in the abstract, the key finding is the observed variance, which underscores the need for adaptive selection. The evaluation likely includes multiple IDS and attack types, but exact numbers are not provided in the source.

Industrial control systems (ICS) face a dynamic and evolving threat landscape. Effective security demands detection strategies that can react in a timely manner to changing threat situations. However, static deployment of intrusion detection systems (IDS) may not suffice when attack scenarios vary. The authors propose a counter-threat intelligence sharing based mechanism to select appropriate detectors for current circumstances. This digest summarizes the poster's motivation, approach, evaluation, and implications.

The core idea is a counter-threat intelligence sharing mechanism that enables selection of threat-appropriate IDS. The mechanism leverages shared intelligence about current threats to inform detector selection. To demonstrate potential, the authors conduct attack-level performance evaluations of various intrusion detection systems. The evaluation assesses IDS performance across different attack scenarios, revealing how detection efficacy varies. The methodology involves:

The variance in IDS performance across attack scenarios highlights a critical limitation of static detection strategies. A counter-threat intelligence sharing mechanism offers a promising approach to dynamically select the most suitable IDS for the current threat environment. This can improve overall security posture by ensuring that detection capabilities align with the actual threats faced. The proposed mechanism also facilitates timely reactions to evolving threat situations. Future work may involve implementing and testing the mechanism in real-world ICS environments, as well as addressing challenges such as intelligence sharing trust and scalability. The poster contributes a conceptual foundation for threat-appropriate IDS selection, with potential applications in industrial control system security.

CS practitioners and researchers

Opening member content…