ITACA: Flexible, scalable network analysis

Hurley, John K.; Muñoz, Arantxa; Sezer, Sakir

doi:10.1109/icc.2012.6363995

Cited by 13 publications

(10 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…3) IDS Process Core: The IDS process core is developed based on the internet traffic and content analysis (ITACA) tool [29], which is a software platform for traffic sniffing and real-time network analysis [2]. The SCADA-specific IDS is developed in C/C++ using the ITACA platform.…”

Section: ) Ids Configuration Modulementioning

confidence: 99%

Multidimensional Intrusion Detection System for IEC 61850-Based SCADA Networks

Yang

Gao

et al. 2017

IEEE Trans. Power Delivery

Self Cite

130

View full text Add to dashboard Cite

Abstract--Emerging cybersecurity vulnerabilities in supervisory control and data acquisition (SCADA) systems are becoming urgent engineering issues for modern substations. This paper proposes a novel intrusion detection system (IDS) tailored for cybersecurity of IEC 61850 based substations. The proposed IDS integrates physical knowledge, protocol specifications and logical behaviors to provide a comprehensive and effective solution that is able to mitigate various cyberattacks. The proposed approach comprises access control detection, protocol whitelisting, model-based detection, and multi-parameter based detection. This SCADA-specific IDS is implemented and validated using a comprehensive and realistic cyber-physical test-bed and data from a real 500kV smart substation.

show abstract

Section: ) Ids Configuration Modulementioning

confidence: 99%

Multidimensional Intrusion Detection System for IEC 61850-Based SCADA Networks

Yang

Gao

et al. 2017

IEEE Trans. Power Delivery

Self Cite

130

View full text Add to dashboard Cite

show abstract

“…ITACA [14] is a software platform for traffic sniffing and real-time IP network analysis which has been developed by the Centre for Secure Information Technologies (CSIT) at the Queen's University of Belfast. The extendable analysis tool enables the implementation of plugins to perform specific tasks, e.g., IDS.…”

Section: Scada-ids Implementationmentioning

confidence: 99%

“…It includes the following main modules: the protocol extractor, packet storage, flow look up table, event generator, plug-in queues and event controller. The detailed modules of the ITACA core architecture are described in [14]. 3) To implement the PBW discussed in Section IV-B, the Perl compatible regular expressions (PCRE) library is utilized to identify the SCADA protocol based on application-layer data using regular expression pattern matching.…”

Section: Scada-ids Implementationmentioning

confidence: 99%

Multiattribute SCADA-Specific Intrusion Detection System for Power Networks

Yang

McLaughlin

Sezer

et al. 2014

IEEE Trans. Power Delivery

152

View full text Add to dashboard Cite

Abstract--The increased interconnectivity and complexity of Supervisory Control and Data Acquisition (SCADA) systems in power system networks has exposed the systems to a multitude of potential vulnerabilities. In this paper we present a novel approach for a next generation SCADA-specific Intrusion Detection System (IDS). The proposed system analyses multiple attributes in order to provide a comprehensive solution able to mitigate varied cyberattacks threats. The multi-attribute IDS comprises a heterogeneous whitelist and behavior-based concept in order to make SCADA cyber systems more secure. This paper also proposes a multilayer cyber-security framework based on IDS for protecting SCADA cyber-security in Smart Grids without compromising the availability of normal data. In addition, this paper presents a SCADA-specific cyber-security test-bed to investigate simulated attacks and which has been used in the paper to validate the proposed approach.

show abstract

“…The extendable and flexible analysis tool enables the implementation of plug-ins to perform specific tasks, e.g., intrusion detection. The detailed modules and functions of the ITACA architecture are described in [18]. In this paper, the Stateful Protocol Analysis (SPA) module in the stateful IDS plug-in is developed in C/C++ using the ITACA platform, as shown in Fig.…”

Section: Methodsmentioning

confidence: 99%

“…The proposed stateful IDS is therefore implemented using the Internet Traffic and Content Analysis (ITACA) tool. ITACA [18] is a software platform for traffic sniffing and real-time IP network analysis which has been developed by the Center for Secure Information Technologies (CSIT) at Queen's University Belfast. The extendable and flexible analysis tool enables the implementation of plug-ins to perform specific tasks, e.g., intrusion detection.…”

Section: Methodsmentioning

confidence: 99%