  Due to the fourth industrial revolution, industrial applications make use of
the progress in communication and embedded devices. This allows industrial
users to increase efficiency and manageability while reducing cost and effort.
Furthermore, the fourth industrial revolution, creating the so-called Industry
4.0, opens a variety of novel use and business cases in the industrial
environment. However, this progress comes at the cost of an enlarged attack
surface of industrial companies. Operational networks that have previously been
phyiscally separated from public networks are now connected in order to make
use of new communication capabilites. This motivates the need for industrial
intrusion detection solutions that are compatible to the long-term operation
machines in industry as well as the heterogeneous and fast-changing networks.
In this work, process data is analysed. The data is created and monitored on
real-world hardware. After a set up phase, attacks are introduced into the
systems that influence the process behaviour. A time series-based anomaly
detection approach, the Matrix Profiles, are adapted to the specific needs and
applied to the intrusion detection. The results indicate an applicability of
these methods to detect attacks in the process behaviour. Furthermore, they are
easily integrated into existing process environments. Additionally, one-class
classifiers One-Class Support Vector Machines and Isolation Forest are applied
to the data without a notion of timing. While Matrix Profiles perform well in
terms of creating and visualising results, the one-class classifiers perform
poorly.
