The student will use publicly available datasets from industrial control systems such the Secure Water Treatment (SWaT) Dataset, to build a lightweight intrusion detection system tailored for ICS protocols. These datasets contain not only benign traffic but also malicious, which can be used to build (machine learning based) models that distinguish between the different types of attacks. Other parameters for detecting attacks, such as PLC data, can also be taken into consideration.