Sökning: WFRF:(Lin Chih Yuan 1987 ) >
Understanding IEC-6...
Understanding IEC-60870-5-104 Traffic Patterns in SCADA Networks
-
- Lin, Chih-Yuan, 1987- (författare)
- Linköpings universitet,Programvara och system,Tekniska fakulteten,RTSLAB - Real-Time Systems Laboratory
-
- Nadjm-Tehrani, Simin, 1958- (författare)
- Linköpings universitet,Programvara och system,Tekniska fakulteten,RTSLAB - Real-Time Systems Laboratory
-
(creator_code:org_t)
- 2018-05-22
- 2018
- Engelska.
-
Ingår i: Proceedings of the 4th ACM Workshop on Cyber-Physical System Security. - NY, USA : ACM. - 9781450357555 ; , s. 51-60
- Relaterad länk:
-
https://liu.diva-por... (primary) (Raw object)
-
visa fler...
-
http://liu.diva-port...
-
https://urn.kb.se/re...
-
https://doi.org/10.1...
-
visa färre...
Abstract
Ämnesord
Stäng
- The IEC-60870-5-104 (IEC-104) protocol is commonly used in Supervisory Control and Data Acquisition (SCADA) networks to operate critical infrastructures, such as power stations. As the importance of SCADA security is growing, characterization and modeling of SCADA traffic for developing defense mechanisms based on the regularity of the polling mechanism used in SCADA systems has been studied, whereas the characterization of traffic caused by non-polling mechanisms, such as spontaneous events, has not been well-studied. This paper provides a first look at how the traffic flowing between SCADA components changes over time. It proposes a method built upon Probabilistic Suffix Tree (PST) to discover the underlying timing patterns of spontaneous events. In 11 out of 14 tested data sequences, we see evidence of existence of underlying patterns. Next, the prediction capability of the approach, useful for devising anomaly detection mechanisms, is studied. While some data patterns enable an 80% prediction possibility, more work is needed to tune the method for higher accuracy.
Ämnesord
- TEKNIK OCH TEKNOLOGIER -- Elektroteknik och elektronik -- Kommunikationssystem (hsv//swe)
- ENGINEERING AND TECHNOLOGY -- Electrical Engineering, Electronic Engineering, Information Engineering -- Communication Systems (hsv//eng)
Nyckelord
- iec-60870-5-104
- probabilistic suffix tree(pst)
- scada
- traffic patterns
Publikations- och innehållstyp
- ref (ämneskategori)
- kon (ämneskategori)
Hitta via bibliotek
Till lärosätets databas