Security Of Supervisory Control And Data Acquisition Systems Research Articles

Anomaly Detection for SCADA System Security Based on Unsupervised Learning and Function Codes Analysis in the DNP3 Protocol

An Intrusion Detection System (IDS) is a tool used primarily for security monitoring, which is one of the security strategies for Supervisory Control and Data Acquisition (SCADA) systems. Distributed Network Protocol version 3 (DNP3) is the predominant SCADA protocol in the energy sector. In this paper, we have developed an effective and flexible IDS for DNP3 networks, observing that most critical operations in DNP3 systems are utilized based on the function codes in DNP3 application messages, and that exploitation of those function codes enables attackers to manipulate the system operation. Our proposed anomaly-detection method deals with possible attacks that can bypass any rule-based deep packet inspection once attackers take over servers in the system. First, we generated datasets that reflected DNP3 traffic characteristics observed in real-world power grid substations for a reasonably long time. Next, we extracted input features that consisted of the occurrences of function codes per TCP connection, along with TCP characteristics. We then used an unsupervised deep learning model (Autoencoder) to learn the normal behavior of DNP3 traffic based on function code patterns. We called our approach FC-AE-IDS (Function Code Autoencoder IDS). The evaluation of the proposed method was carried out on three different datasets, to prove its accuracy and effectiveness. To evaluate the effectiveness of our proposed method, we performed various experiments that resulted in more than 95% detection accuracy for all considered attack scenarios that are mentioned in this study. We compared our approach to an IDS that is based on traditional features, to show the effectiveness of our approach.

A Classy Multifacet Clustering and Fused Optimization Based Classification Methodologies for SCADA Security

Detecting intrusions from the supervisory control and data acquisition (SCADA) systems is one of the most essential and challenging processes in recent times. Most of the conventional works aim to develop an efficient intrusion detection system (IDS) framework for increasing the security of SCADA against networking attacks. Nonetheless, it faces the problems of complexity in classification, requiring more time for training and testing, as well as increased misprediction results and error outputs. Hence, this research work intends to develop a novel IDS framework by implementing a combination of methodologies, such as clustering, optimization, and classification. The most popular and extensively utilized SCADA attacking datasets are taken for this system’s proposed IDS framework implementation and validation. The main contribution of this work is to accurately detect the intrusions from the given SCADA datasets with minimized computational operations and increased accuracy of classification. Additionally the proposed work aims to develop a simple and efficient classification technique for improving the security of SCADA systems. Initially, the dataset preprocessing and clustering processes were performed using the multifacet data clustering model (MDCM) in order to simplify the classification process. Then, the hybrid gradient descent spider monkey optimization (GDSMO) mechanism is implemented for selecting the optimal parameters from the clustered datasets, based on the global best solution. The main purpose of using the optimization methodology is to train the classifier with the optimized features to increase accuracy and reduce processing time. Moreover, the deep sequential long short term memory (DS-LSTM) is employed to identify the intrusions from the clustered datasets with efficient data model training. Finally, the proposed optimization-based classification methodology’s performance and results are validated and compared using various evaluation metrics.

Detection and Blocking of Replay, False Command, and False Access Injection Commands in SCADA Systems with Modbus Protocol

Industrial control systems (ICS) are being used for surveillance and controlling numerous industrial process plants in national critical infrastructures. Supervisory control and data acquisition (SCADA) system is a core component in ICS systems for continuous monitoring and controlling these process plants. Legacy SCADA systems are working in isolated networks and using proprietary communication protocols which made them less exposed to cyber threats. In recent times, these ICS systems have been connected to Internet and corporate networks for data sharing and remote monitoring. They are also using open protocols and operating systems. This leads to vulnerabilities of the system to cyberattacks. Cybersecurity threats are more prevalent than ever in ICS systems. These attacks may be external or internal. Modbus is a widely deployed communication protocol for SCADA communications. There is no security in design of Modbus protocol, and it is vulnerable to numerous cyberattacks. In this paper, we worked for False Command Injection attack, False Access Injection attack, and replay attacks on Modbus protocol. Initially, a real-time SCADA testbed was set up, and we envisaged the impact of these attacks on Modbus protocol data using the testbed. In this work, we used local area network (LAN) environment only for simulating the attacks. We assumed that the attacks penetrated the LAN network. We proposed and developed (a) a method to detect replay attacks by incorporating time stamp and sequence number in Modbus communications and (b) a frame filtering module which will block unauthorized attacks like False Command Injection and False Access Injection attacks to reach programmable logic controller (PLC). Numbers of attacks were simulated and the performance of the method was measured using attack block rate (ABR). It blocked 97% of malicious Modbus transactions or attacks to reach the PLC. It protects SCADA systems from attackers, which is a core component of industrial control systems. The solution enhanced the security of SCADA systems with Modbus protocol.

A Survey on SCADA Systems: Secure Protocols, Incidents, Threats and Tactics

Supervisory Control and Data Acquisition (SCADA) systems are the underlying monitoring and control components of critical infrastructures, such as power, telecommunication, transportation, pipelines, chemicals and manufacturing plants. Legacy SCADA systems operated on isolated networks, that made them less exposed to Internet threats. However, the increasing connection of SCADA systems to the Internet, as well as corporate networks, introduces severe security issues. Security considerations for SCADA systems are gaining higher attention, as the number of security incidents against these critical infrastructures is increasing. In this survey, we provide an overview of the general SCADA architecture, along with a detailed description of the SCADA communication protocols. Additionally, we discuss certain high-impact security incidents, objectives, and threats. Furthermore, we carry out an extensive review of the security proposals and tactics that aim to secure SCADA systems. We also discuss the state of SCADA system security. Finally, we present the current research trends and future advancements of SCADA security.

Proposal of a Secure Modbus RTU Communication with Adi Shamir's Secret Sharing Method

Drinking fresh water, turning the lights on, travelling by tram, calling our family or getting a medical treatment are usual activities, but the underlying SCADA (Supervisory Control and Data Acquisition) systems like CIS (Critical Infrastructure Systems), ICS (Industrial Control Systems) or DCS (Distributed Control Systems) were always the target of many types of attacks, endangered the above mentioned simple activities. During the last decades because of the fast spread of the internet based services and the continuous technical development these systems become more vulnerable than ever. Full reconstruction and innovative changes in older SCADA systems has high cost, and it is not always rewarding. Communication protocols as Modbus (1979) serve as a main basis for SCADA systems, so security of Modbus has a major impact of the security of SCADA systems. Our paper raises and answers questions about the security of the Modbus RTU protocol. We focus on the serial Modbus protocol, because in that method we found many unsolved problems, like lack of authentication of the participants, lack of secure channel and so on. The aim of this paper to propose a secure communication alternative for Modbus RTU @ RS485 wire. The main advantage of the proposed method is the coexistence with traditional slaves and bus systems and only software update is necessary.

Security of SCADA systems against cyber–physical attacks

Supervisory control and data acquisition (SCADA) systems are highly distributed systems used to control and monitor geographically dispersed assets—often scattered over thousands of square kilometers— in which centralized data acquisition is critical to system operation [1]. These large-scale industrial control systems (ICSs) have been playing an extremely important role in most safety-critical infrastructures [2], such as electric power grids, transportation systems, communication networks, oil and gas pipelines, water distribution and irrigation networks, and multiple facilities including heating, ventilation and air conditioning systems for buildings, and traffic control systems for airports—the list is long. These safetycritical assets, however, are becoming increasingly susceptible to cyber–physical attacks1 on both physical and cyber layers [3].

Model-based autonomic security management for cyber-physical infrastructures

Supervisory control and data acquisition (SCADA) systems, widely used in monitoring and controlling critical infrastructure systems, are highly vulnerable to cyber attacks. Current security solutions can protect SCADA systems from known cyber assaults, but most require human intervention. This paper presents a model-based autonomic security management (ASM) approach that monitors SCADA system performance and proactively predicts upcoming cyber attacks that may disrupt physical processes. We also discuss the feasibility of intrusion detection systems for laboratory-scale known and unknown attack detection. The ASM approach provides the most appropriate countermeasure recommendations, which may be deployed (semi-) autonomously based on an adaptive feedback mechanism. We present a gas pipeline case study and carry out function code scanning and malicious parameter injection attacks to validate the self-protection feature. Experimental results show that the ASM approach strengthens the SCADA system security, reduces protection time delays and toward achieving normal operations with little or no human intervention.

Model-based autonomic security management for cyber-physical infrastructures

Supervisory control and data acquisition (SCADA) systems, widely used in monitoring and controlling critical infrastructure systems, are highly vulnerable to cyber attacks. Current security solutions can protect SCADA systems from known cyber assaults, but most require human intervention. This paper presents a model-based autonomic security management (ASM) approach that monitors SCADA system performance and proactively predicts upcoming cyber attacks that may disrupt physical processes. We also discuss the feasibility of intrusion detection systems for laboratory-scale known and unknown attack detection. The ASM approach provides the most appropriate countermeasure recommendations, which may be deployed (semi-) autonomously based on an adaptive feedback mechanism. We present a gas pipeline case study and carry out function code scanning and malicious parameter injection attacks to validate the self-protection feature. Experimental results show that the ASM approach strengthens the SCADA system security, reduces protection time delays and toward achieving normal operations with little or no human intervention.

THE SCADA REVIEW: SYSTEM COMPONENTS, ARCHITECTURE, PROTOCOLS AND FUTURE SECURITY TRENDS

The Supervisory Control and Data Acquisition (SCADA) system has prominent place and play important roles within real time industrial communication included &#34electric stations, oil stations and water purification plants&#34. In this study; the SCADA System main components, architecture and important protocols, which have been used in SCADA message transmission are reviewed. After review, the current research changes the direction (Section: Future Work) to the security of SCADA system and the existing methods or security methods that have been deployed within the SCADA system. This review also gives directions to secure SCADA network communication.

Analysis of Security of SCADA System

SCADA (Supervisory Control and Data Acquisition) is an important concern about national security of our country and its security professionals. During those early days, a so called "security by obscurity" helped provide a palpable layer of cyber security and defense and a general feeling of immunity kinds of security problems that have started emerging networks to emerge in the mid 1980's, starting with the known Morris Worm. However, with the global standardization of TCP/IP protocol, and for the past 20 years, with the migration of autonomous systems SCADA interconnected power grids, security risks have increased exponentially. The security officials can no longer rely on the isolated nature of these systems to provide protection. Unfortunately, the security of SCADA systems has not kept pace with advances in computer technology. According to a 2003 report by Sandia National Laboratories, the SCADA security is generally five to ten years behind compared to typical systems of information technology. As threat, the contradictory range has expanded to include not only domestic but foreign terrorists, disgruntled internal, organized crime and even international competitors. This volatile convergence of global computer network and critical weaknesses in the operating system and application software system are well understood by opponents. Although a catastrophic failure is unlikely, these risks could be very problematic and cause disruptions in essential services and billions of euros in losses. This study includes a description of the state of the art of attacks against these systems and the reasons for the vulnerability of these systems. [1, 2, 3]

Hybrid Key Management Architecture for Robust SCADA Systems

Recently, as a demand for connecting Supervisory Control and Data Acquisition (SCADA) systems to open networks increases, the study of SCADA system security becomes an issue. Many researchers have proposed key management schemes for SCADA systems. However, previous studies lack the proper considerations for availability. In this paper, we build up cryptographic security requirements for robust SCADA systems. In addition, we propose a hybrid key management architecture for robust SCADA systems which supports replace protocol for availability and reduces the number of keys to be stored in a master terminal unit.

Security and Vulnerability of SCADA Systems over IP-Based Wireless Sensor Networks

An overview of supervisory control and data acquisition (SCADA) systems is presented and relevant security concerns are addressed. To secure IP-based SCADA systems, it is vital to implement secure architectures which prevent access to the SCADA from corporate IT, in addition to excellent management practices in managing IP-based networks. We give an overall explanation of SCADA systems along with their security concerns and vulnerability. In the case of legacy SCADA systems, the concerns regarding security were minimal since it used proprietary networks; however, since the move of SCADA systems to the Internet, security problems have become an imperative issue, especially problems regarding IP-based systems. We also discuss various forms of threats and vulnerabilities on future SCADA systems applied with IPv6 over low-power, wireless personal area networks (6LoWPANs) and suggest security management methods to overcome these concerns. In order to identify and remove various vulnerabilities and threats to SCADA systems over IP-based wireless sensor networks, especially for 6LoWPAN applications, we examine possible threats and propose proper and precise security management methods.

SCADASim—A Framework for Building SCADA Simulations

Supervisory Control and Data Acquisition (SCADA) systems control and monitor industrial and critical infrastructure functions, such as electricity, gas, water, waste, railway, and traffic. Recent attacks on SCADA systems highlight the need of stronger SCADA security. It is important to analyze the security risks and develop appropriate security solutions to protect such systems. However, a key problem is the lack of proper modeling tools to evaluate the security of SCADA systems. As widely accepted in academic and industrial communities, it is impractical to conduct security experiments on live systems. A modeling simulation tool would enable the simulation of SCADA systems with the benefit of testing different attack and security solutions. This paper proposes a simulation tool for building SCADA simulations that supports the integration of external devices and applications. A key benefit of this tool is the ability to test the effect of attacks on real devices and applications, even though using a simulated environment. The paper further describes two case studies that demonstrate how the tool can be efficiently used to create SCADA simulations and perform malicious attacks.

Efficient Secure Group Communications for SCADA

Modern industrial facilities have command and control systems. These industrial command and control systems are commonly called supervisory control and data acquisition (SCADA). In the past, SCADA system has the closed operating environment, so this system were designed without security functionality. These days, as a demand for connecting the SCADA system to the open network increases, the study of SCADA system security is an issue. A key-management scheme is essential for secure SCADA communications. Several key-management schemes for SCADA also have been proposed. Recently, advanced SCADA key-management architecture (ASKMA) was proposed. While previous studies do not support message broadcasting and secure communications, ASKMA supports it. Although the overall performance of ASKMA has many advantages compared to previous studies, it can be less efficient during multicast. In this paper, we propose ASKMA+ which is a more efficient scheme that decreases the computational cost for multicast communication. ASKMA+ reduces the number of keys to be stored in a remote terminal unit and provides multicast and broadcast communications.

Advanced Key-Management Architecture for Secure SCADA Communications

Supervisory control and data-acquisition (SCADA) systems are control systems for many national infrastructures. In the past, SCADA systems were designed without security functionality because of the closed operating environment. However, the security of SCADA systems has become an issue with connection to open networks becoming more common. Any damage to the SCADA system can have a widespread negative effect to society. In this paper, we review constraints and security requirements for SCADA systems and then investigate whether the existing key-management protocols for the SCADA systems satisfy these requirements. Afterward, we propose an advanced key-management architecture fitted for secure SCADA communications. The contributions of our work are two-fold. First, our scheme supports both message broadcasting and secure communication. Second, by evenly spreading much of the total amount of computation across high power nodes (MTU or SUB-MTU), our protocol avoids any potential performance bottleneck of the system while keeping the burden on low power nodes (RTU) at minimal.

Increasing security and protection of SCADA systems through infrastructure resilience

In this paper, we present the approach we have taken in the INcreasing Security and Protection through Infrastructure Resilience (INSPIRE) project to improve the protection of critical information infrastructures. The core idea of the INSPIRE project is to protect critical information infrastructures (CIIs) by appropriately configuring, managing and securing the communication network infrastructure which interconnects supervisory control and data acquisition (SCADA) systems, the key building blocks of CIIs. In order to do so, a self-reconfigurable architecture has been designed, which provides mechanisms for detecting, diagnosing, and treating faults and attacks which might compromise the correct operation of a critical infrastructure. The paper presents the overall architecture of the INSPIRE framework and provides a detailed description of some key system components, namely the subsystems in charge of the monitoring, of the diagnostic activities and of the provision of peer-to-peer (P2P) network support.