1.

0 INTRUSION DETECTION SYSTEM

1.1 Introduction
Intrusion detection is a critical element of an overall balanced security
program. As the name suggests, the purpose of an intrusion detection
system is to detect an intruder approaching a site, facility, or area as
early as possible. In many cases, visual observation of an intruder may
not be possible or may be unreliable due to darkness, lack of personnel,
or visual shielding from landscaping or terrain.
An intrusion detection system may provide the first and only indication
that someone or something is trying to enter the facility premises.

Before beginning the design or evaluation of an intrusion detection

system, it is important to have an understanding of some key issues;
i. What is the facility, space or area to be protected?
ii. How large is the area?
iii. Does the area occupy a level surface?
iv. Is the area enclosed?
v. What humidity, temperature conditions, wind conditions exist?
vi. Are small animals or children living nearby the protected space?
vii. Who is the Perceived Threat?
viii. From whom are we protecting the space against?
ix. What tactics, motivation, skills, knowledge, tools or weapons
might the adversary use? (Protecting a facility from a skilled,
trained terrorist with knowledge of the facility requires a different
tactic than protecting against a high school vandal.)
x. What are known vulnerabilities of the area or space? What are
key assets or targets at the space?
xi. What are the known vulnerabilities or soft targets?
xii. What key assets exist at the facility? (Treated water, pumps,
generators, chemical storage, SCADA workstations, etc.)
xiii. How will system monitoring take place?
xiv. How will alarm signals be transmitted back to a monitoring
system?
xv. What monitoring system is in place to receive the alarmsa
SCADA system or a separate intrusion detection system?
xvi. Who will monitor the alarms, and is this on a continuous basis, or
as alarms come in?
xvii. What power and communication methods exist?
xviii. What electrical power is available for security hardware, if any?
Will hardwired systems be used or are wireless communication
methods being considered?

1.2 Alarm Activation Point

For an intrusion detection alarm to be processed and subsequent action
taken, the following must occurThe sensor must be activated, an alarm
signal must be initiated, the alarm reported back to the control system,
and the alarm assessed for further response.
To be effective, all of these steps must occur and the alarm condition
occurs before the adversary can complete his task. Refer to Fig.1
depicting a linear beam (photoelectric beam).

Fig. 1. Linear beam (photo electric beam)

As such, it is important that the system detection occurs as early (quickly)
as possible after intrusion. The goal is that the intrusion detection system
provides early warning of intrusion, requires low maintenance, and has
high-performance characteristics.

1.3 Performance Characteristics

How do we compare the performance of intrusion detection systems? We
look at the following elements; the Probability of Detection, the False
Alarm Rate, and the
Probability of Defeat.

a. Probability of Detection. The probability of detection (Pd) is the

probability that the system will detect an intruder. Under perfect
conditions, this would be (1.0) or 100 percent detection. However,
because no sensor is perfect, this number will be less than 1.0.
Factors affecting probability of detection include the intended
target, sensor design, installation settings, weather, climate, etc.
The higher the sensitivity of the system, the higher the probability
of detection. All things considered equal, the higher the probability
of detection, the better the sensor.

b. False Alarm Rate. The false alarm rate (FAR) is a measure of the
frequency of invalid alarms or alarms that are not caused due to
intrusion, but instead by other means (rain, animals, wind-blown
debris, vibration, etc.) The lower the false alarm rate, the better the
sensor.

c. Vulnerability to Defeat. The vulnerability to defeat is a measure

of the elements that can be used to defeat the sensor. There are
 two general ways to defeat an intrusion detection system
bypassing and spoofing.

Bypassing intrusion detection systems involves going around the

detection area or detection space (jumping over a fence-mounted
detection system).

Spoofing intrusion detection systems involve cloaking the intruder in

some manner, allowing them to pass through the normal detection zone
without generating an alarm (rubbing grease on the lens of a passive
infrared detection system, causing the system to be masked).
The more difficult it is to defeat a sensor, the better will it perform.

1.4 Design concept and goal

When designing any perimeter intrusion detection system, the goal is to
achieve
the best possible performance. These concepts apply:
i. No gaps in coveragea continuous line of detection around the
perimeter area or interior space should exist.
ii. Suitability for physical and environmental conditionsthe sensor
must be appropriate for the area being monitored (temperature,
humidity, rain, fog, wind, pollution).
iii. Layers of protectiona fundamental security concept is that
multiple, layered detection systems are much more effective
single systems. If one system is bypassed or defeated, the
remaining systems are still in place to detect the intruder.

1.5 Intrusion Detection Sensor Categories

Exterior or Interior. Intrusion detection sensors may be classified as
exterior or interior sensors. Exterior intrusion sensors are those that sense
an intrusion crossing an outdoor perimeter boundary or area. Exterior
sensors will have a lower probability of detection and higher false alarm
rate due to the less predictable nature of their external environment.
Interior intrusion sensors sense intrusion within an interior area, space or
opening, or from a person moving or touching an object (doors, hatches,
etc.).
Passive or Active. Is the sensor a passive device, receiving energy
(heat, vibration, and sound) from the environment? Or is the sensor
actively transmitting energy (microwaves, photoelectric beams, infrared
beams) into the environment and analyzing the received signal? Passive
devices are more cost effective than active devices and require less
power to operate.
Covert or Visible. Is the sensor hidden from view (covertly installed) or
is it visible (installed within view)?
Volumetric or Line/Boundary Detection. Is the sensor designed to
monitor a volume of space, and will an alarm be generated if an intruder
enters the space? Or is the sensor monitoring a line or boundary, and an
alarm is generated if an intruder crosses the boundary?
Line of Sight or Terrain Following. Is the sensor detecting within a
straight line of sight, or does the sensor follow the terrain to adjust for
hills, valleys, depressions,
etc.?

Exterior Sensor Types. Several types of exterior intrusion detection

sensors exist, and they may be classified according to their type, method
of use, style, and mode of application. The following exterior systems are
most applicable to water system applications:
Buried Line Sensors. Buried line sensors include; pressure/seismic
sensors, magnetic field sensors, buried ported coaxial cable, and buried
fiber-optic cable sensor systems. Each of these systems relies on sensing
the presence of an intruder by means of a buried cable system within the
ground.
Pressure/Seismic Sensors. Pressure/seismic sensors use a buried
cable system that senses minute vibrations or pressure changes caused
when an intruder walks across or crosses the sensing boundary. The
system may be tuned electronically to filter out windblown debris or small
animal movements.
Magnetic Field Sensors. Magnetic field sensors use a buried cable
system that creates a balanced magnetic field at the surface of the
monitored ground area. When an intruder passes over the sensing area,
the magnetic field is disrupted in proportion to the mass of the intruder.
The system can be tuned.
Ported-Coaxial Buried Cable System. A buried ported-coax cable
system uses a pair of buried coaxial cables, separated by a distance of 6
to 10 ft, which run parallel to the boundary of the area protected. These
cables emit an electronic field that is disturbed when an intruder walks
along or crosses the sensing area.
Fiber-Optic Buried Cable System. Fiber-optic buried cable systems
utilize fiberoptic cable buried below the ground surface. The cables are
placed in a serpentine fashion parallel to the boundary of the area
protected. A light source transmits a beam down the fiber optic cable. The
amount of light refracted within the cable is measured and monitored
continuously by a control system. When an intruder walks along the area
containing the fiber, the soil shifts and the refracted light measurement
changes. By adjusting the system, it can be tuned to filter out small
movements for such items as small animals, rain, or wind-blown debris.
The table below summarises some of these sensors
S/ SENSOR CLASSIFICATIO ADVERSE DEFEAT
N N ENVIRONMEN
T
1 Buried-line Exterior, buried- Lightning, Bridging,
magnetic field line buried power nonmagnetic
sensor line materials
2 Buried-line fiber Exterior, buried- Hail, frozen Bridging
optic cable line ground
3 Electromechanic Exterior, fence Ice coating, Bridging,
al vibration mounted wind trenching
sensor
4 Active infrared Exterior, Ice coating Bridging,
freestanding trenching
5 Passive infrared Exterior, Body Tunneling
sensor freestanding temperature,
outdoor
condition,
floodlights
6 Microwave Exterior, Surface snow Trenching
freestanding
7 Glass break Interior Noisy Muffle
sensor environment breakage
8 Balanced Interior Loose fitting Tailgate
magnetic door doors authorized
switch user

2.0 CLOSED CIRCUIT TELEVISION (CCTV)

Closed circuit television (CCTV) has been used for security purposes for
decades, but recent evolution in the digital hardware has made CCTV
smarter, more reliable, more efficient, and more effective for premise
security in all types of applications. CCTV is used to serve several basic
security functions.
First, video serves as a surveillance tool. Cameras can be strategically
located to provide a vantage point that guards or authorities would not
have under practical circumstances. Cameras are often located on traffic
stanchions, signposts, high masts, and tall building structures. The video
from these cameras is then fed to a convenient location for observation
by authorities.
Second, CCTV cameras act as a deterrent to would-be wrong doers. The
simple presence of surveillance cameras often thwarts shop lifters,
thieves, and assailants and vandals from achieving their goals. The
realization that they may not finish their task without prosecution is
enough to make many criminals second-guess their commitment to their
goals.
Third, CCTV has been used for decades as a means to gather evidence in
order to aid authorities in criminal investigations. Convenience stores,
banks, hotels, and large retail establishments have been recording daily
operations in hopes of catching images of criminals in the middle of their
acts. In many instances, CCTV recordings are the only substantial
evidence that prosecutors have to help link a particular perpetrator to
crime. In the past, analog tape (VHS & Beta) has been
3.0