Defeating Node Based Attacks on SCADA Systems Using Probabilistic Packet Observation

Abstract

Supervisory control and data acquisition (SCADA) systems form a vital part of the critical infrastructure. Such systems are subject to sophisticated attacks by subverted processes which can manipulate message content or forge authentic messages, undermining the action of the plant, whilst hiding the effects from operators. In this paper, we propose a novel network protocol which, using techniques related to IP Traceback, enables the efficient discovery of subverted nodes, assuming an initial detection event. We discuss its advantages over previous techniques in this area and provide a formal model.

Agent Interaction and State Determination in SCADA Systems

“…The π-Calculus provides a formal mechanism for modeling process actions [7][8][9]12]. The associated algebraic theory facilitates formal reasoning, including automating proofs [12].…”

“…For the defense strategy, an operator employs observer agents for state determination and trusted routes for alerts regarding critical conditions. As described in [8,9,13], each network node that receives a message adds its address…”

“…The attributes provide a formal definition for observer agents, which use the information to make state determinations. Note that in [9], IP traceback algorithms were used to detecting the locations of malicious agents -a different goal from the one addressed in this work. Here, the observer algorithm uses messages and copies of messages to determine a trusted set of paths.…”