Diderot

Abstract

In this paper, an Intrusion Detection and Prevention System (IDPS) for the Distributed Network Protocol 3 (DNP3) Supervisory Control and Data Acquisition (SCADA) systems is presented. The proposed IDPS is called DIDEROT (Dnp3 Intrusion DetEction pReventiOn sysTem) and relies on both supervised Machine Learning (ML) and unsupervised/outlier ML detection models capable of discriminating whether a DNP3 network flow is related to a particular DNP3 cyberattack or anomaly. First, the supervised ML detection model is applied, trying to identify whether a DNP3 network flow is related to a specific DNP3 cyberattack. If the corresponding network flow is detected as normal, then the unsupervised/outlier ML anomaly detection model is activated, seeking to recognise the presence of a possible anomaly. Based on the DIDEROT detection results, the Software Defined Networking (SDN) technology is adopted in order to mitigate timely the corresponding DNP3 cyberattacks and anomalies. The performance of DIDEROT is demonstrated using real data originating from a substation environment. CCS CONCEPTS• Security and privacy → Intrusion detection systems; • Computing methodologies → Neural networks.

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

“…Furthermore, two DNNs were also adopted and evaluated. The first one is called DIDEROT Autoencoder and originates from our previous work in [41]. The second one was developed during this work.…”

“…The aforementioned cyberattacks are implemented by Smod, a widely known pen-testing tool related to Modbus [39,40]. The Modbus Network Flow-Based Anomaly Detection Model adopts the DIDEROT Autoencoder [41], identifying anomalous Modbus/TCP network flows. The DIDEROT autoencoder is analysed in our previous work in [41].…”

“…The Modbus Network Flow-Based Anomaly Detection Model adopts the DIDEROT Autoencoder [41], identifying anomalous Modbus/TCP network flows. The DIDEROT autoencoder is analysed in our previous work in [41]. Finally, the last model focuses on the payload of the Modbus/TCP packets, recognising Modbus/TCP anomalous packets based on the Isolation Forest method [42].…”

“…Both models were trained, utilising normal DNP3 network flow statistics coming from a real substation environment as well as from the DNP3 intrusion detection dataset of N.Rodofile et al [46]. The evaluation analysis of these DNP3 intrusion/anomaly detection models is presented in our previous work in [41]. The IEC 60870-5-104 Network Flow-Based Anomaly Detection Model adopts the Isolation Forest method [42], detecting anomalous IEC 60870-5-104 network flows.…”

IDS for Industrial Applications: A Federated Learning Approach with Active Personalization

“…Attacks against the industrial sector, as indicated from past incidents, can have severe consequences. Such incidents include the December 2015 cyberattack against Ukraine's power grid, which resulted in complete electricity disruption for 225,000 people [12,13]. In addition, as Stuxnet, the first known cyber warfare weapon [14,15], indicated, nuclear power plants have also been targeted by cyberattacks, thus emphasizing the urgent need for adequate security measures in such critical domains.…”