A Review of Research Work on Network-Based SCADA Intrusion Detection Systems

Rakas, Slavica V. Boštjančič; Stojanović, Mirjana D.; Marković-Petrović, Jasna D.

doi:10.1109/access.2020.2994961

Cited by 73 publications

(36 citation statements)

References 56 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Similarly, after giving the necessary information regarding the CPS and intrusion detection methods, Mitchel and Chen study a plethora of specially designed IDS for the CPS. In [17] [35]- [37]. Therefore, taking into account the aforementioned points, subsequently, we discuss some specific IDS cases that use DL techniques for detecting intrusions against the SG and SCADA systems.…”

Section: Related Workmentioning

confidence: 99%

A Unified Deep Learning Anomaly Detection and Classification Approach for Smart Grid Environments

Siniosoglou

Radoglou-Grammatikis

Efstathopoulos³

et al. 2021

IEEE Trans. Netw. Serv. Manage.

121

View full text Add to dashboard Cite

The interconnected and heterogeneous nature of the next-generation Electrical Grid (EG), widely known as Smart Grid (SG), bring severe cybersecurity and privacy risks that can also raise domino effects against other Critical Infrastructures (CIs). In this paper, we present an Intrusion Detection System (IDS) specially designed for the SG environments that use Modbus/Transmission Control Protocol (TCP) and Distributed Network Protocol 3 (DNP3) protocols. The proposed IDS called MENSA (anoMaly dEtection aNd claSsificAtion) adopts a novel Autoencoder-Generative Adversarial Network (GAN) architecture for (a) detecting operational anomalies and (b) classifying Modbus/TCP and DNP3 cyberattacks. In particular, MENSA combines the aforementioned Deep Neural Networks (DNNs) in a common architecture, taking into account the adversarial loss and the reconstruction difference. The proposed IDS is validated in four real SG evaluation environments, namely (a) SG lab, (b) substation, (c) hydropower plant and (d) power plant, solving successfully an outlier detection (i.e., anomaly detection) problem as well as a challenging multiclass classification problem consisting of 14 classes (13 Modbus/TCP cyberattacks and normal instances). Furthermore, MENSA can discriminate five cyberattacks against DNP3. The evaluation results demonstrate the efficiency of MENSA compared to other Machine Learning (ML) and Deep Learning (DL) methods in terms of Accuracy, False Positive Rate (FPR), True Positive Rate (TPR) and the F1 score.

show abstract

Section: Related Workmentioning

confidence: 99%

A Unified Deep Learning Anomaly Detection and Classification Approach for Smart Grid Environments

Siniosoglou

Radoglou-Grammatikis

Efstathopoulos³

et al. 2021

IEEE Trans. Netw. Serv. Manage.

121

View full text Add to dashboard Cite

show abstract

“…Major architectural components of a modern SCADA system include: field devices, RTUs, MTUs, programmable logic controllers (PLCs), intelligent electronic devices (IEDs), HMI, Historian, etc. [5,16]. Figure 3 presents the simplified architectural structure of a SCADA system.…”

Section: Brief Overview Of Modern Scada Architecturementioning

confidence: 99%

“…Proprietary SCADA systems' components which includes the human machine interface (HMI), sensors, master terminal units (MTU), remote terminal units (RTU), etc. are vulnerable to different forms of intrusions [5,15,16]. Also, the various protocols being used for communication, which include Modbus, DNP3, Profibus, etc., can be remotely targeted, via cyberattacks [4].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Review of Research Works on Supervised Learning Algorithms for SCADA Intrusion Detection and Classification

et al. 2021

View full text Add to dashboard Cite

Supervisory Control and Data Acquisition (SCADA) systems play a significant role in providing remote access, monitoring and control of critical infrastructures (CIs) which includes electrical power systems, water distribution systems, nuclear power plants, etc. The growing interconnectivity, standardization of communication protocols and remote accessibility of modern SCADA systems have contributed massively to the exposure of SCADA systems and CIs to various forms of security challenges. Any form of intrusive action on the SCADA modules and communication networks can create devastating consequences on nations due to their strategic importance to CIs’ operations. Therefore, the prompt and efficient detection and classification of SCADA systems intrusions hold great importance for national CIs operational stability. Due to their well-recognized and documented efficiencies, several literature works have proposed numerous supervised learning techniques for SCADA intrusion detection and classification (IDC). This paper presents a critical review of recent studies whereby supervised learning techniques were modelled for SCADA intrusion solutions. The paper aims to contribute to the state-of-the-art, recognize critical open issues and offer ideas for future studies. The intention is to provide a research-based resource for researchers working on industrial control systems security. The analysis and comparison of different supervised learning techniques for SCADA IDC systems were critically reviewed, in terms of the methodologies, datasets and testbeds used, feature engineering and optimization mechanisms and classification procedures. Finally, we briefly summarized some suggestions and recommendations for future research works.

show abstract

“…Boštjančič Rakas et al [43] A review and classification of available intrusion detection systems for SCADA. Provides a structured evaluation methodology and also details for development of IDS testbeds.…”

Section:    mentioning

confidence: 99%

Experimenting With Digital Signatures Over a DNP3 Protocol in a Multitenant Cloud-Based SCADA Architecture

Marian

Cusman²,

Stinga

et al. 2020

IEEE Access

View full text Add to dashboard Cite

The ideas presented in this paper are summarized as follows. The first idea entails improving the security of supervisory control and data acquisition (SCADA) architectures by means of asymmetric cryptography and digital signatures and measuring the performance overhead. This allows achieving some obvious subsequent goals such as data-origin authentication, and the traceability and implicit nonrepudiation of commands given to intelligent field and direct control equipment. The possibility to include digital signatures with a minimum impact on a standard and a reliable data communication protocol, such as Distributed Network Protocol version 3 (DNP3), also known to have a mature, industrially validated, opensource implementation, has been tested and the results are presented. A second idea concerns designing and developing a multitenant cloud-based architecture for a SCADA environment. This hypothesis focuses on certain SCADA operators that manage multiple industrial control systems (ICS) and intend to consolidate process data in a centralized manner. INDEX TERMS digital signatures, cybersecurity, SCADA, industrial control system, cloud-based services.

show abstract

A Review of Research Work on Network-Based SCADA Intrusion Detection Systems

Cited by 73 publications

References 56 publications

A Unified Deep Learning Anomaly Detection and Classification Approach for Smart Grid Environments

A Unified Deep Learning Anomaly Detection and Classification Approach for Smart Grid Environments

A Review of Research Works on Supervised Learning Algorithms for SCADA Intrusion Detection and Classification

Experimenting With Digital Signatures Over a DNP3 Protocol in a Multitenant Cloud-Based SCADA Architecture

Contact Info

Product

Resources

About