{"id":"https://openalex.org/W4386710224","doi":"https://doi.org/10.1145/3617692","title":"Goosewolf: An Embedded Intrusion Detection System for Advanced Programmable Logic Controllers","display_name":"Goosewolf: An Embedded Intrusion Detection System for Advanced Programmable Logic Controllers","publication_year":2023,"publication_date":"2023-09-13","ids":{"openalex":"https://openalex.org/W4386710224","doi":"https://doi.org/10.1145/3617692"},"language":"en","primary_location":{"id":"doi:10.1145/3617692","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3617692","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3617692","source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3617692","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5083140073","display_name":"David S. Allison","orcid":"https://orcid.org/0000-0002-5832-1988"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"David Allison","raw_affiliation_strings":["AIT Austrian Institute of Technology GmbH, Austria"],"raw_orcid":"https://orcid.org/0000-0002-5832-1988","affiliations":[{"raw_affiliation_string":"AIT Austrian Institute of Technology GmbH, Austria","institution_ids":["https://openalex.org/I132118926"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027789250","display_name":"Kieran McLaughlin","orcid":"https://orcid.org/0000-0002-1299-2364"},"institutions":[{"id":"https://openalex.org/I126231945","display_name":"Queen's University Belfast","ror":"https://ror.org/00hswnk62","country_code":"GB","type":"education","lineage":["https://openalex.org/I126231945"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Kieran McLaughlin","raw_affiliation_strings":["Queen\u2019s University Belfast, United Kingdom","Queen's University Belfast, United Kingdom"],"raw_orcid":"https://orcid.org/0000-0002-1299-2364","affiliations":[{"raw_affiliation_string":"Queen\u2019s University Belfast, United Kingdom","institution_ids":["https://openalex.org/I126231945"]},{"raw_affiliation_string":"Queen's University Belfast, United Kingdom","institution_ids":["https://openalex.org/I126231945"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5102973502","display_name":"Paul Smith","orcid":"https://orcid.org/0000-0002-8990-6751"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Paul Smith","raw_affiliation_strings":["AIT Austrian Institute of Technology GmbH, Austria"],"raw_orcid":"https://orcid.org/0000-0002-8990-6751","affiliations":[{"raw_affiliation_string":"AIT Austrian Institute of Technology GmbH, Austria","institution_ids":["https://openalex.org/I132118926"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.6911,"has_fulltext":true,"cited_by_count":6,"citation_normalized_percentile":{"value":0.65103952,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":98},"biblio":{"volume":"4","issue":"4","first_page":"1","last_page":"19"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.9937999844551086,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12495","display_name":"Electrostatic Discharge in Electronics","score":0.9915000200271606,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/programmable-logic-controller","display_name":"Programmable logic controller","score":0.8253018856048584},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.6930805444717407},{"id":"https://openalex.org/keywords/industrial-control-system","display_name":"Industrial control system","score":0.663362979888916},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5764541625976562},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5179609060287476},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5070571899414062},{"id":"https://openalex.org/keywords/control-logic","display_name":"Control logic","score":0.4813128709793091},{"id":"https://openalex.org/keywords/control-system","display_name":"Control system","score":0.4411834478378296},{"id":"https://openalex.org/keywords/scada","display_name":"SCADA","score":0.4113115072250366},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3846389949321747},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.37625691294670105},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.3221345543861389},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.3122706711292267},{"id":"https://openalex.org/keywords/computer-hardware","display_name":"Computer hardware","score":0.19538813829421997},{"id":"https://openalex.org/keywords/electrical-engineering","display_name":"Electrical engineering","score":0.08199197053909302}],"concepts":[{"id":"https://openalex.org/C37374048","wikidata":"https://www.wikidata.org/wiki/Q188674","display_name":"Programmable logic controller","level":2,"score":0.8253018856048584},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.6930805444717407},{"id":"https://openalex.org/C40071531","wikidata":"https://www.wikidata.org/wiki/Q2513962","display_name":"Industrial control system","level":3,"score":0.663362979888916},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5764541625976562},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5179609060287476},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5070571899414062},{"id":"https://openalex.org/C2776350369","wikidata":"https://www.wikidata.org/wiki/Q843479","display_name":"Control logic","level":2,"score":0.4813128709793091},{"id":"https://openalex.org/C17500928","wikidata":"https://www.wikidata.org/wiki/Q959968","display_name":"Control system","level":2,"score":0.4411834478378296},{"id":"https://openalex.org/C113863187","wikidata":"https://www.wikidata.org/wiki/Q17498","display_name":"SCADA","level":2,"score":0.4113115072250366},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3846389949321747},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.37625691294670105},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.3221345543861389},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.3122706711292267},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.19538813829421997},{"id":"https://openalex.org/C119599485","wikidata":"https://www.wikidata.org/wiki/Q43035","display_name":"Electrical engineering","level":1,"score":0.08199197053909302},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3617692","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3617692","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3617692","source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},{"id":"pmh:oai:eprints.lancs.ac.uk:201727","is_oa":false,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4306401916","display_name":"Lancaster EPrints (Lancaster University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67415387","host_organization_name":"Lancaster University","host_organization_lineage":["https://openalex.org/I67415387"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":null,"raw_type":"Journal Article"},{"id":"pmh:oai:pure.qub.ac.uk/portal:openaire/3d25eecf-32f1-4471-bad4-d18a89b02729","is_oa":true,"landing_page_url":"https://pure.qub.ac.uk/en/publications/3d25eecf-32f1-4471-bad4-d18a89b02729","pdf_url":"https://pureadmin.qub.ac.uk/ws/files/528662733/3617692.pdf","source":{"id":"https://openalex.org/S4306402319","display_name":"Research Portal (Queen's University Belfast)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I126231945","host_organization_name":"Queen's University Belfast","host_organization_lineage":["https://openalex.org/I126231945"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Allison, D, McLaughlin, K & Smith, P 2023, 'Goosewolf: an embedded intrusion detection system for advanced programmable logic controllers', Digital Threats: Research and Practice, vol. 4, no. 4, 59. https://doi.org/10.1145/3617692","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1145/3617692","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3617692","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3617692","source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6499999761581421,"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4386710224.pdf","grobid_xml":"https://content.openalex.org/works/W4386710224.grobid-xml"},"referenced_works_count":15,"referenced_works":["https://openalex.org/W1454791451","https://openalex.org/W1590786596","https://openalex.org/W2077290416","https://openalex.org/W2089944128","https://openalex.org/W2184570813","https://openalex.org/W2521150000","https://openalex.org/W2600332792","https://openalex.org/W2794229387","https://openalex.org/W2810208108","https://openalex.org/W3035172199","https://openalex.org/W3185317467","https://openalex.org/W4246606610","https://openalex.org/W4246714686","https://openalex.org/W4298218030","https://openalex.org/W6940965711"],"related_works":["https://openalex.org/W2309980522","https://openalex.org/W2187618570","https://openalex.org/W4252573951","https://openalex.org/W2902958991","https://openalex.org/W2801513872","https://openalex.org/W2516092834","https://openalex.org/W2615554433","https://openalex.org/W2804225172","https://openalex.org/W2007955754","https://openalex.org/W3084463301"],"abstract_inverted_index":{"Critical":[0],"infrastructures":[1],"are":[2,14,45,147],"making":[3],"increasing":[4],"use":[5,119],"of":[6,28,68,102,120,166,183],"digital":[7],"technology":[8],"for":[9,109],"process":[10,131,145],"control.":[11],"While":[12],"there":[13],"benefits,":[15],"such":[16,76],"as":[17,77],"increased":[18],"efficiency":[19],"and":[20,80,89,143],"new":[21],"functionality,":[22],"digitalization":[23],"also":[24],"introduces":[25],"the":[26,46,52,71,83,100,124,136,144,152,170,184],"risk":[27],"cyber-attacks":[29,69],"to":[30,62,65,85,92,126,149],"systems":[31],"that":[32,54],"support":[33],"critical":[34],"functions.":[35],"A":[36],"valuable":[37],"target":[38],"in":[39,70,132,157],"these":[40],"Industrial":[41],"Control":[42],"Systems":[43],"(ICSs)":[44],"Programmable":[47],"Logic":[48],"Controllers":[49],"(PLCs)":[50],"controlling":[51],"machinery":[53],"manages":[55],"a":[56,66,94,103,110,128,158,164],"physical":[57],"process.":[58],"PLCs":[59],"have":[60,82],"proven":[61],"be":[63,90],"vulnerable":[64],"range":[67,165],"past;":[72],"however,":[73],"newer":[74],"technologies":[75,122],"embedded":[78],"servers":[79],"virtualization":[81],"potential":[84],"improve":[86],"this":[87,98],"situation":[88],"used":[91],"monitor":[93,127],"PLC\u2019s":[95,137,171],"function.":[96],"In":[97],"article,":[99],"implementation":[101],"Host-based":[104],"Intrusion":[105],"Detection":[106],"System":[107],"(HIDS)":[108],"modern":[111],"PLC":[112,125,153,178,186],"is":[113,174],"described.":[114],"This":[115],"method":[116],"uniquely":[117],"makes":[118],"native":[121],"on":[123],"dynamic":[129],"simulated":[130],"real":[133],"time.":[134],"Both":[135],"integrity":[138],"(checksum,":[139],"file":[140],"size,":[141],"etc.)":[142],"control":[146,172],"monitored":[148],"determine":[150],"whether":[151],"has":[154],"been":[155],"compromised":[156,175],"cyber-attack.":[159],"The":[160],"proposed":[161],"solution":[162],"detects":[163],"attacks,":[167],"even":[168],"when":[169],"logic":[173],"and\u2014unlike":[176],"previous":[177],"HIDS":[179],"methods\u2014requires":[180],"no":[181],"modification":[182],"underlying":[185],"technology.":[187]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":2}],"updated_date":"2026-07-29T09:40:50.615796","created_date":"2025-10-10T00:00:00"}