Timing Patterns and Correlations in Spontaneous SCADA Traffic for Anomaly Detection

Lin, Chih-Yuan,1987-Linköpings universitet,Programvara och system,Tekniska fakulteten,Real-time Systems Laboratory (author)

Funding Agencies: Swedish Civil Contingencies Agency (MSB) through the RICS project
Supervisory Control and Data Acquisition (SCADA) systems operate critical infrastructures in our modern society despite their vulnerability to attacks and misuse. There are several anomaly detection systems based on the cycles of polling mechanisms used in SCADA systems, but the feasibility of anomaly detection systems based on non-polling traffic, so called spontaneous events, is not well-studied. This paper presents a novel approach to modeling the timing characteristics of spontaneous events in an IEC-60870-5-104 network and exploits the model for anomaly detection. The system is tested with a dataset from a real power utility with injected timing effects from two attack scenarios. One attack causes timing anomalies due to persistent malfunctioning in the field devices, and the other generates intermittent anomalies caused by malware on the field devices, which is considered as stealthy. The detection accuracy and timing performance are promising for all the experiments with persistent anomalies. With intermittent anomalies, we found that our approach is effective for anomalies in low-volume traffic or attacks lasting over 1 hour.

Nadjm-Tehrani, Simin,1958-Linköpings universitet,Programvara och system,Tekniska fakulteten,Real-time Systems Laboratory(Swepub:liu)simna73 (author)
Linköpings universitetProgramvara och system (creator_code:org_t)

In:PROCEEDINGS OF THE 22ND INTERNATIONAL SYMPOSIUM ON RESEARCH IN ATTACKS, INTRUSIONS AND DEFENSES: USENIX - The Advanced Computing Systems Association, s. 73-889781939133076

About the subject

NATURAL SCIENCES: NATURAL SCIENCES; and Computer and Inf ...; and Computer Enginee ...

Kungliga biblioteket hanterar dina personuppgifter i enlighet med EU:s dataskyddsförordning (2018), GDPR. Läs mer om hur det funkar här.
Så här hanterar KB dina uppgifter vid användning av denna tjänst.