Related Experiment Videos
Securing Cyber-Physical Water Infrastructures: A Hybrid Intrusion Detection System for IoT Telemetry and Industrial
César López Rodríguez1, Miguel Ángel Ortega Velázquez1, Antonio J Jara1
1Libelium Comunicaciones Distribuidas S.L., 30562 Murcia, Spain.
Sensors (Basel, Switzerland)
|May 27, 2026
Summary
This study introduces a novel hybrid Intrusion Detection System (IDS) for water infrastructure cybersecurity. The system achieves 100% detection of cyber-physical threats in IT/OT environments, ensuring operational continuity.
Area of Science:
- Cybersecurity
- Industrial Control Systems Security
- Water Infrastructure Protection
Background:
- Critical water infrastructures face increasing cyber-physical threats due to digitalization and IoT integration, eroding traditional security measures.
- Legacy industrial protocols lack intrinsic security, and new regulatory mandates like NIS2 and CRA require enhanced risk monitoring.
- Converged IT/OT environments present unique challenges for detecting sophisticated cyber threats.
Purpose of the Study:
- To develop a non-intrusive, hybrid Intrusion Detection System (IDS) for securing critical water infrastructures in converged IT/OT environments.
- To enhance the detection of cyber-physical threats targeting legacy industrial protocols and IoT applications within water systems.
- To ensure regulatory compliance and operational continuity through robust cybersecurity measures.
Main Methods:
- Engineered a hybrid IDS on the Snort 3 multi-threaded engine to capture IT/OT network traffic (North-South and East-West).
- Developed a defense-in-depth rule set leveraging threat intelligence (MITRE ATT&CK, CISA KEV) for Deep Packet Inspection (DPI).
- Validated the IDS using high-volume synthetic packet captures, including specific manufacturer vulnerabilities (CVEs) and industrial protocols (Modbus, S7Comm, CIP, MQTT, HTTP).
Main Results:
- Achieved a 100% detection rate for cyber-physical threats, improving from a 0% baseline.
- Demonstrated high scalability and minimal computational overhead, processing over 170,000 packets with zero dropped packets.
- Successfully performed Deep Packet Inspection across legacy industrial and modern IoT protocols.
Conclusions:
- The developed contextualized signature approach provides deterministic security for water infrastructures.
- The hybrid IDS ensures operational continuity and facilitates regulatory compliance with frameworks like NIS2 and CRA.
- This non-intrusive solution effectively addresses the cybersecurity challenges in modern, digitized water systems.
Related Concept Videos
01:21Multiple Pipe Systems
Multipipe systems consist of complex configurations of interconnected pipes designed to transport fluids efficiently across intricate networks. They are essential in engineering applications requiring precise control over flow distribution, pressure, and head loss. They are categorized into series, parallel, loop, and network configurations, each distinguished by unique flow characteristics and applications.
Series Configuration
In a series configuration, fluid flows sequentially from one pipe...
Series Configuration
In a series configuration, fluid flows sequentially from one pipe...
01:21Pilot and Numeric Relaying
Pilot relaying is a type of differential protection used in power systems. It compares electrical quantities at the terminals of equipment via a communication channel instead of direct relay interconnection. This method is essential for transmission lines where the terminals are far apart, typically up to 80 km for lines with 69 to 115 kV ratings. Four types of communication channels are used for pilot relaying:
01:25Distribution Reliability and Automation
Distribution reliability in electrical power systems is critical for ensuring an uninterrupted power supply to consumers at minimal cost. According to IEEE Standard Terms, reliability is the probability that a device will function without failure over a specified time period or amount of usage. For electric power distribution, this translates to maintaining continuous power supply and addressing customer concerns over power outages. Several indices, as defined by IEEE Standard 1366-2012, are...