Building a SCADA Security Testbed

In order to detect abnormal communication behaviors efficiently in today's industrial control system, a new intrusion detection algorithm based on One-Class Support Vector Machine (OCSVM) is proposed in this paper. In this algorithm, a normal communication behavior model is established by using OCSVM, and the Particle Swarm Optimization algorithm is designed to optimize OCSVM model parameters. Furthermore, we adopt the normal Modbus function code sequence to train OCSVM model, and then use this model to detect abnormal Modbus TCP traffic. Our simulation results show that the proposed algorithm not only is efficient and reliable but also meets the real-time requirements of anomaly detection in industrial control system.

show abstract

“…As shown in Figure 2, the Modbus/TCP packet format [26] mainly includes three parts: MBAP packet header, Modbus function code, and data.…”

Section: Feature Extraction and Data Preprocessingmentioning

confidence: 99%

Intrusion detection algorithm based on OCSVM in industrial control system

Shang

Zeng

Wan

et al. 2015

Security Comm. Networks

View full text Add to dashboard Cite

show abstract

“…However, the high fidelity of this testing environment is counterbalanced by its poor flexibility and the high cost of maintenance of a similar architecture. Another approach that uses real physical devices was proposed by Queiroz, et al [9]. In this case only the sensors and actuators are real physical devices, while the remaining components such as PLCs, and the communications protocols between them are implemented as OMNeT++ modules.…”

Section: Related Workmentioning

confidence: 99%

“…In the same category we find the work of Hiyama and Ueno [13] The present work builds on the advantages of the previously mentioned methods. For the physical part, instead of using real components as was the case of [7], [8] and [9], it uses simulation. This provides an efficient, safe and low-cost approach with fast and accurate analysis capabilities.…”

Section: Related Workmentioning

confidence: 99%

“…The main novelty of the proposed framework is that it combines the Emulab testbed with typical NICS components and Simulink models in order to provide a set of key functionalities that are missing from related techniques [7,8,9,10,11,12,13,14]. As the Emulab testbed was specifically designed to provide capabilities for advanced networking experimentation, it already includes most of the functionalities required by our framework (see Table 2), e.g.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A cyber-physical experimentation environment for the security analysis of networked industrial control systems

Genge

Siaterlis

Fovino

et al. 2012

Computers & Electrical Engineering

View full text Add to dashboard Cite

“…Although from one point of view such a testbed would provide reliable experimental data, since almost everything is real, it would be hardly able to support tests on large infrastructures such as the process system of a chemical installation, because that would require a complete industrial system to experiment with. Another approach that uses real physical devices has been proposed by Queiroz, et al [5]. In this case only the sensors and actuators are real physical devices, while the remaining components, e.g., PLCs, and the communication protocols between them are implemented as OMNeT++ modules.…”

Section: Related Workmentioning

confidence: 99%

Using Soft Real-Time Simulation in a Hybrid Environment for Cyber-Physical Security Experiments

Genge

Siaterlis

2011

2011 IEEE 20th International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprises

View full text Add to dashboard Cite

Abstract-The study of complex systems, either physical or cyber, could be carried out by experimenting with real systems, software simulators or emulators. This paper presents an innovative framework for an experimentation environment that incorporates both physical and cyber systems. The proposed approach uses soft real-time simulation for physical processes (based on Simulink) and an emulation testbed (based on Emulab) for ICT components. The paper also presents two coupling algorithms that couple the simulation time to the system time, in order to achieve soft real-time simulation on a multitasking OS. The main difference between the two algorithms is the size of the critical section that enables concurrent access to a shared resource between emulated and simulated environments. The experimental results show that resource sharing between the two environments is a major concern and future algorithms should also consider a proper analysis of critical sections.

show abstract

Building a SCADA Security Testbed

Cited by 76 publications

References 8 publications

Intrusion detection algorithm based on OCSVM in industrial control system

Intrusion detection algorithm based on OCSVM in industrial control system

A cyber-physical experimentation environment for the security analysis of networked industrial control systems

Using Soft Real-Time Simulation in a Hybrid Environment for Cyber-Physical Security Experiments

Contact Info

Product

Resources

About