Moving Target Defense Based on Adaptive Forwarding Path Migration for Securing the SCADA Network

Chenxi Hu,Shahram Babaie,Wenjie Kang,Peidong Zhu,Yinqiao Xiong,Weiheng Shi,Yifan Hu,Yufei Zhu,Peng Xun

doi:10.1155/2021/1704125

Abstract

Static characteristics of supervisory control and data acquisition (SCADA) system are often exploited to perform malicious activities on smart grids. Most of the time, the success of cyberattacks begins with the profiling of the target system and follows by the analysis of the limited resources. To alleviate the asymmetry between attack and defense, network-based moving target defense (MTD) techniques have been applied in the network system to defend against cyberattacks by constructing a dynamic attack surface to the adversary. In this paper, we propose a novel MTD technique based on adaptive forwarding path migration (AFPM) that focuses on improving the defense capability and optimizing the network performance of path mutation. Considering the transient problems present in path mutation caused by the dynamic switching of the forwarding path, we formalize the mutation constraints based on the satisfiability modulo theory (SMT) to select the mutation path. Considering the limited defense capability of path mutation owing to the traditional mutation selection mechanism, we design the mutation path generation algorithm based on the network security capacity matrix to obtain an optimal combination of mutation path and mutation period. Finally, we compare and analyze various cyber defense techniques used in the SCADA network and demonstrate experimentally that our MTD technique can prevent more than 92% of passive monitoring under specified conditions while ensuring the quality of service (QoS) to be almost the same as the static network.

Highlights

Supervisory control and data acquisition (SCADA) system as an essential backbone of smart grids plays an important role in monitoring, controlling, and protecting critical infrastructure resources incorporated within the system
Influential cyberattacks [1,2,3] that have led to massive power outages show more and more static network configurations or underlying vulnerabilities present in the cyber-physical system (CPS) that can be exploited by the adversary
Mutation router the network topology of our test bed, where network-based moving target defense (MTD) strategies are deployed in the backbone network that is targeted by the attacker

Summary

Introduction

Supervisory control and data acquisition (SCADA) system as an essential backbone of smart grids plays an important role in monitoring, controlling, and protecting critical infrastructure resources incorporated within the system. Duan et al [13] presented a proactive random route mutation (RRM) technique to defend against reconnaissance, eavesdropping, and DoS attacks by modeling and solving a constraint satisfaction problem, where they formalized the mutation constraints using the SMT to identify the optimal forwarding path. To invalidate the adversary’s knowledge and plan of attacks against critical network resources, Gillani et al [18] employed virtual networks (VN) to proactively defend against sophisticated DDoS (Distributed DoS) attacks like Crossfire by dynamically reallocating network resources using VN placement and offering constant VN migration to new resources

Background and Motivation

Adaptive Forwarding Path Migration

Path Mutation Security Analysis

Evaluation

Conclusion and Future Work