liu.seSearch for publications in DiVA
1231 of 3
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
A timing approach to network-based anomaly detection for SCADA systems
Linköping University, Department of Computer and Information Science, Software and Systems. Linköping University, Faculty of Science & Engineering. (RTSLAB - Real-Time Systems Laboratory)ORCID iD: 0000-0003-2596-9355
2020 (English)Licentiate thesis, comprehensive summary (Other academic)
Abstract [en]

Supervisory Control and Data Acquisition (SCADA) systems control and monitor critical infrastructure in society, such as electricity transmission and distribution systems. Modern SCADA systems are increasingly adopting open architectures, protocols, and standards and being connected to the Internet to enable remote control. A boost in sophisticated attacks against SCADA systems makes SCADA security a pressing issue. An Intrusion Detection System (IDS) is a security countermeasure that monitors a network and tracks unauthenticated activities inside the network. Most commercial IDSs used in general IT systems are signature-based, by which an IDS compares the system behaviors with known attack patterns. Unfortunately, recent attacks against SCADA systems exploit zero-day vulnerabilities in SCADA devices which are undetectable by signature-based IDSs.

This thesis aims to enhance SCADA system monitoring by anomaly detection that models normal behaviors and finds deviations from the model. With anomaly detection, zero-day attacks are possible to detect. We focus on modeling the timing attributes of SCADA traffic for two reasons: (1) the timing regularity fits the automation nature of SCADA systems, and (2) the timing information (i.e., arrival time) of a packet is captured and sent by a network driver where an IDS is located. Hence, it’s less prone to intentional manipulation by an attacker, compared to the payload of a packet.

This thesis first categorises SCADA traffic into two groups, request-response and spontaneous traffic, and studies data collected in three different protocol formats (Modbus, Siemens S7, and IEC-60870-5-104). The request-response traffic is generated by a polling mechanism. For this type of traffic, we model the inter-arrival times for each command and response pair with a statistical approach. Results presented in this thesis show that request-response traffic exists in several SCADA traffic sets collected from systems with different sizes and settings. The proposed statistical approach for request-response traffic can detect attacks having subtle changes in timing, such as a single packet insertion and TCP prediction for two of the three SCADA protocols studied.

The spontaneous traffic is generated by remote terminal units when they see significant changes in measurement values. For this type of traffic, we first use a pattern mining approach to find the timing characteristics of the data. Then, we model the suggested attributes with machine learning approaches and run it on traffic collected in a real power facility. We test our anomaly detection model with two types of attacks. One causes persistent anomalies and another only causes intermittent ones. Our anomaly detector exhibits a 100% detection rate with at most 0.5% false positive rate for the attacks with persistent anomalies. For the attacks with intermittent anomalies, we find our approach effective when (1) the anomalies last for a longer period (over 1 hour), or (2) the original traffic has relatively low volume.

Place, publisher, year, edition, pages
Linköping: Linköping University Electronic Press, 2020. , p. 32
Series
Linköping Studies in Science and Technology. Licentiate Thesis, ISSN 0280-7971 ; 1881
Keywords [en]
SCADA securuty, anomaly detection
National Category
Computer Systems
Identifiers
URN: urn:nbn:se:liu:diva-165155DOI: 10.3384/lic.diva-165155ISBN: 9789179298364 (print)OAI: oai:DiVA.org:liu-165155DiVA, id: diva2:1424481
Presentation
2020-06-11, Alan Turing, E-Building, Campus Valla, Linköping, 10:00 (English)
Opponent
Supervisors
Funder
Swedish Civil Contingencies AgencyAvailable from: 2020-05-14 Created: 2020-04-17 Last updated: 2020-06-02Bibliographically approved
List of papers
1. Timing-Based Anomaly Detection in SCADA Networks
Open this publication in new window or tab >>Timing-Based Anomaly Detection in SCADA Networks
2018 (English)In: Critical Information Infrastructures Security, Springer, 2018, p. 48-59Conference paper, Published paper (Refereed)
Abstract [en]

Supervisory Control and Data Acquisition (SCADA) systems that operate our critical infrastructures are subject to increased cyber attacks. Due to the use of request-response communication in polling, SCADA traffic exhibits stable and predictable communication patterns. This paper provides a timing-based anomaly detection system that uses the statistical attributes of the communication patterns. This system is validated with three datasets, one generated from real devices and two from emulated networks, and is shown to have a False Positive Rate (FPR) under 1.4%. The tests are performed in the context of three different attack scenarios, which involve valid messages so they cannot be detected by whitelisting mechanisms. The detection accuracy and timing performance are adequate for all the attack scenarios in request-response communications. With other interaction patterns (i.e. spontaneous communications), we found instead that 2 out of 3 attacks are detected.

Place, publisher, year, edition, pages
Springer, 2018
Series
Lecture Notes in Computer Science, ISSN 0302-9743, E-ISSN 1611-3349
Keywords
SCADA, Industrial Control System (ICS), Anomaly detection, Traffic periodicity
National Category
Computer Systems
Identifiers
urn:nbn:se:liu:diva-154394 (URN)10.1007/978-3-319-99843-5_5 (DOI)978-3-319-99842-8 (ISBN)978-3-319-99843-5 (ISBN)
Conference
CRITIS, Lucca, Italy, 8-13 October, 2017
Projects
RICS (Resilient Information and Control Systems)
Available from: 2019-02-11 Created: 2019-02-11 Last updated: 2020-05-14Bibliographically approved
2. Understanding IEC-60870-5-104 Traffic Patterns in SCADA Networks
Open this publication in new window or tab >>Understanding IEC-60870-5-104 Traffic Patterns in SCADA Networks
2018 (English)In: Proceedings of the 4th ACM Workshop on Cyber-Physical System Security, NY, USA: ACM , 2018, p. 51-60Conference paper, Published paper (Refereed)
Abstract [en]

The IEC-60870-5-104 (IEC-104) protocol is commonly used in Supervisory Control and Data Acquisition (SCADA) networks to operate critical infrastructures, such as power stations. As the importance of SCADA security is growing, characterization and modeling of SCADA traffic for developing defense mechanisms based on the regularity of the polling mechanism used in SCADA systems has been studied, whereas the characterization of traffic caused by non-polling mechanisms, such as spontaneous events, has not been well-studied. This paper provides a first look at how the traffic flowing between SCADA components changes over time. It proposes a method built upon Probabilistic Suffix Tree (PST) to discover the underlying timing patterns of spontaneous events. In 11 out of 14 tested data sequences, we see evidence of existence of underlying patterns. Next, the prediction capability of the approach, useful for devising anomaly detection mechanisms, is studied. While some data patterns enable an 80% prediction possibility, more work is needed to tune the method for higher accuracy.

Place, publisher, year, edition, pages
NY, USA: ACM, 2018
Series
CPSS ’18
Keywords
iec-60870-5-104, probabilistic suffix tree(pst), scada, traffic patterns
National Category
Communication Systems
Identifiers
urn:nbn:se:liu:diva-154412 (URN)10.1145/3198458.3198460 (DOI)000461237800008 ()978-1-4503-5755-5 (ISBN)
Conference
CPSS, Incheon, Korea, June 4, 2018
Projects
RICS (Resilient Information and Control Systems)
Note

Funding agencies: Swedish Civil Contingencies Agency (MSB)

Available from: 2019-02-11 Created: 2019-02-11 Last updated: 2020-05-14Bibliographically approved
3. Timing Patterns and Correlations in Spontaneous SCADA Traffic for Anomaly Detection
Open this publication in new window or tab >>Timing Patterns and Correlations in Spontaneous SCADA Traffic for Anomaly Detection
2019 (English)In: : 22nd International Symposium on Research on Attacks, Intrusions, and Defenses (RAID), USENIX - The Advanced Computing Systems Association, 2019, p. 73-88Conference paper, Published paper (Refereed)
Abstract [en]

Supervisory Control and Data Acquisition (SCADA) systems operate critical infrastructures in our modern society despite their vulnerability to attacks and misuse. There are several anomaly detection systems based on the cycles of polling mechanisms used in SCADA systems, but the feasibility of anomaly detection systems based on non-polling traffic, so called spontaneous events, is not well-studied. This paper presents a novel approach to modeling the timing characteristics of spontaneous events in an IEC-60870-5-104 network and exploits the model for anomaly detection. The system is tested with a dataset from a real power utility with injected timing effects from two attack scenarios. One attack causes timing anomalies due to persistent malfunctioning in the field devices, and the other generates intermittent anomalies caused by malware on the field devices, which is considered as stealthy. The detection accuracy and timing performance are promising for all the experiments with persistent anomalies. With intermittent anomalies, we found that our approach is effective for anomalies in low-volume traffic or attacks lasting over 1 hour.

Place, publisher, year, edition, pages
USENIX - The Advanced Computing Systems Association, 2019
Keywords
Anomaly detection, SCADA systems, IEC-60870-5-104, Critical infrastructure
National Category
Computer Engineering
Identifiers
urn:nbn:se:liu:diva-161757 (URN)
Conference
22nd International Symposium on Research on Attacks, Intrusions, and Defenses (RAID), Beijing, China, September 23-25, 2019
Note

Funding Agencies: Swedish Civil Contingencies Agency (MSB) through the RICS project

Available from: 2019-11-08 Created: 2019-11-08 Last updated: 2020-05-14Bibliographically approved

Open Access in DiVA

fulltext(3370 kB)5 downloads
File information
File name FULLTEXT01.pdfFile size 3370 kBChecksum SHA-512
b398f620f60a84672b58e16d57735272cbc098e4030b8836c496e0d377023db11a6e6d26a9e89d88069d2fb9f09ebec34bf4c02185ca248455b5d3f755f7787f
Type fulltextMimetype application/pdf
Order online >>

Other links

Publisher's full text

Authority records BETA

Lin, Chih-Yuan

Search in DiVA

By author/editor
Lin, Chih-Yuan
By organisation
Software and SystemsFaculty of Science & Engineering
Computer Systems

Search outside of DiVA

GoogleGoogle Scholar
Total: 5 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

doi
isbn
urn-nbn

Altmetric score

doi
isbn
urn-nbn
Total: 109 hits
1231 of 3
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • oxford
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf