查看文章

The detection of process anomalies is a critical step in defending a physical plant against cyber-attacks. We propose a framework named DRACE that includes a set of metrics to evaluate the effectiveness of anomaly detectors, referred to as Intrusion Detection Systems (IDS). Different from those used in the literature, the proposed metrics are designed to serve as a means for plant engineers and IT specialists to compare multiple detectors prior to deciding which to deploy. The metrics were found effective in evaluating the effectiveness of several anomaly detectors of different origins in a case study conducted in the iTrust laboratory.