liu.seSearch for publications in DiVA
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Understanding IEC-60870-5-104 Traffic Patterns in SCADA Networks
Linköping University, Department of Computer and Information Science, Software and Systems. Linköping University, Faculty of Science & Engineering. (RTSLAB - Real-Time Systems Laboratory)ORCID iD: 0000-0003-2596-9355
Linköping University, Department of Computer and Information Science, Software and Systems. Linköping University, Faculty of Science & Engineering. (RTSLAB - Real-Time Systems Laboratory)ORCID iD: 0000-0002-1485-0802
2018 (English)In: Proceedings of the 4th ACM Workshop on Cyber-Physical System Security, NY, USA: ACM , 2018, p. 51-60Conference paper, Published paper (Refereed)
Abstract [en]

The IEC-60870-5-104 (IEC-104) protocol is commonly used in Supervisory Control and Data Acquisition (SCADA) networks to operate critical infrastructures, such as power stations. As the importance of SCADA security is growing, characterization and modeling of SCADA traffic for developing defense mechanisms based on the regularity of the polling mechanism used in SCADA systems has been studied, whereas the characterization of traffic caused by non-polling mechanisms, such as spontaneous events, has not been well-studied. This paper provides a first look at how the traffic flowing between SCADA components changes over time. It proposes a method built upon Probabilistic Suffix Tree (PST) to discover the underlying timing patterns of spontaneous events. In 11 out of 14 tested data sequences, we see evidence of existence of underlying patterns. Next, the prediction capability of the approach, useful for devising anomaly detection mechanisms, is studied. While some data patterns enable an 80% prediction possibility, more work is needed to tune the method for higher accuracy.

Place, publisher, year, edition, pages
NY, USA: ACM , 2018. p. 51-60
Series
CPSS ’18
Keywords [en]
iec-60870-5-104, probabilistic suffix tree(pst), scada, traffic patterns
National Category
Communication Systems
Identifiers
URN: urn:nbn:se:liu:diva-154412DOI: 10.1145/3198458.3198460ISI: 000461237800008ISBN: 978-1-4503-5755-5 (print)OAI: oai:DiVA.org:liu-154412DiVA, id: diva2:1287470
Conference
CPSS, Incheon, Korea, June 4, 2018
Projects
RICS (Resilient Information and Control Systems)
Note

Funding agencies: Swedish Civil Contingencies Agency (MSB)

Available from: 2019-02-11 Created: 2019-02-11 Last updated: 2020-05-14Bibliographically approved
In thesis
1. A timing approach to network-based anomaly detection for SCADA systems
Open this publication in new window or tab >>A timing approach to network-based anomaly detection for SCADA systems
2020 (English)Licentiate thesis, comprehensive summary (Other academic)
Abstract [en]

Supervisory Control and Data Acquisition (SCADA) systems control and monitor critical infrastructure in society, such as electricity transmission and distribution systems. Modern SCADA systems are increasingly adopting open architectures, protocols, and standards and being connected to the Internet to enable remote control. A boost in sophisticated attacks against SCADA systems makes SCADA security a pressing issue. An Intrusion Detection System (IDS) is a security countermeasure that monitors a network and tracks unauthenticated activities inside the network. Most commercial IDSs used in general IT systems are signature-based, by which an IDS compares the system behaviors with known attack patterns. Unfortunately, recent attacks against SCADA systems exploit zero-day vulnerabilities in SCADA devices which are undetectable by signature-based IDSs.

This thesis aims to enhance SCADA system monitoring by anomaly detection that models normal behaviors and finds deviations from the model. With anomaly detection, zero-day attacks are possible to detect. We focus on modeling the timing attributes of SCADA traffic for two reasons: (1) the timing regularity fits the automation nature of SCADA systems, and (2) the timing information (i.e., arrival time) of a packet is captured and sent by a network driver where an IDS is located. Hence, it’s less prone to intentional manipulation by an attacker, compared to the payload of a packet.

This thesis first categorises SCADA traffic into two groups, request-response and spontaneous traffic, and studies data collected in three different protocol formats (Modbus, Siemens S7, and IEC-60870-5-104). The request-response traffic is generated by a polling mechanism. For this type of traffic, we model the inter-arrival times for each command and response pair with a statistical approach. Results presented in this thesis show that request-response traffic exists in several SCADA traffic sets collected from systems with different sizes and settings. The proposed statistical approach for request-response traffic can detect attacks having subtle changes in timing, such as a single packet insertion and TCP prediction for two of the three SCADA protocols studied.

The spontaneous traffic is generated by remote terminal units when they see significant changes in measurement values. For this type of traffic, we first use a pattern mining approach to find the timing characteristics of the data. Then, we model the suggested attributes with machine learning approaches and run it on traffic collected in a real power facility. We test our anomaly detection model with two types of attacks. One causes persistent anomalies and another only causes intermittent ones. Our anomaly detector exhibits a 100% detection rate with at most 0.5% false positive rate for the attacks with persistent anomalies. For the attacks with intermittent anomalies, we find our approach effective when (1) the anomalies last for a longer period (over 1 hour), or (2) the original traffic has relatively low volume.

Place, publisher, year, edition, pages
Linköping: Linköping University Electronic Press, 2020. p. 32
Series
Linköping Studies in Science and Technology. Licentiate Thesis, ISSN 0280-7971 ; 1881
Keywords
SCADA securuty, anomaly detection
National Category
Computer Systems
Identifiers
urn:nbn:se:liu:diva-165155 (URN)10.3384/lic.diva-165155 (DOI)9789179298364 (ISBN)
Presentation
2020-06-11, Alan Turing, E-Building, Campus Valla, Linköping, 10:00 (English)
Opponent
Supervisors
Funder
Swedish Civil Contingencies Agency
Available from: 2020-05-14 Created: 2020-04-17 Last updated: 2020-06-02Bibliographically approved

Open Access in DiVA

fulltext(1686 kB)84 downloads
File information
File name FULLTEXT02.pdfFile size 1686 kBChecksum SHA-512
30e411d80ec1f911cbd05d66bb612ade90ae365525cc65928a7d5218fd8a5da56944d857528e9bea9c0445039cc2d85b8c8c3b3d3120d8f21a447616fa1806d5
Type fulltextMimetype application/pdf

Other links

Publisher's full text

Authority records BETA

Lin, Chih-YuanNadjm-Tehrani, Simin

Search in DiVA

By author/editor
Lin, Chih-YuanNadjm-Tehrani, Simin
By organisation
Software and SystemsFaculty of Science & Engineering
Communication Systems

Search outside of DiVA

GoogleGoogle Scholar
Total: 84 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

doi
isbn
urn-nbn

Altmetric score

doi
isbn
urn-nbn
Total: 75 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf