Last Line of Defense: Reliability Through Inducing Cyber Threat Hunting With Deception in SCADA Networks

Abstract

There exists a gap between existing security mechanisms and their ability to detect advancing threats. Antivirus and EDR (End Point Detection and Response) aim to detect and prevent threats; such security mechanisms are reactive. This approach did not prove to be effective in protecting against stealthy attacks. SCADA (Supervisory Control and Data Acquisition) security is crucial for any country. However, SCADA is always an easy target for adversaries due to a lack of security for heterogeneous devices. An attack on SCADA is mainly considered a national-level threat. Recent research on SCADA security has not considered "unknown threats," which has left a gap in security. The proactive approach, such as threat hunting, is the need of the hour. In this research, we investigated that threat hunting in conjunction with cyber deception and kill chain has countervailing effects on detecting SCADA threats and mitigating them. We have used the concept of "decoy farm" in the SCADA network, where all attacks are engaged. Moreover, we present a novel threat detection and prevention approach for SCADA, focusing on unknown threats. To test the effectiveness of approach, we emulated several Linux and Windows-based attacks on a simulated SCADA network. We have concluded that our approach detects and prevents the attacker before using the current reactive approach and security mechanism for SCADA with enhanced protection for heterogeneous devices. The results and experiments show that the proposed threat hunting approach has significantly improved the threat detection ability.

Turning the Hunted into the Hunter via Threat Hunting: Life Cycle, Ecosystem, Challenges and the Great Promise of AI

“…A decoy plan has been introduced in [183] to assist in mitigating threats against Supervisory Control and Data Acquisition (SCADA). The planned decoy will take unknown threats so that researchers can find the gaps in data [183].Professionals can use SCADA to increase detection abilities more than compared to traditional mechanisms [183]. This tool will help defenders identify malicious attacks in social networks.…”

“…Towards other challenges, there is a viable work, [183], that shows last line of defense in reliability through inducing cyber threat hunting with deception in SCADA networks.…”

Explainable artificial intelligence envisioned security mechanism for cyber threat hunting

“…Recent studies on SCADA system's security have not taken unknown threats into account, which has left a security gap. As a result, taking a proactive approach is generally necessary, like cyber threat hunting 5 . Cyber threat hunting is part of cyber security, which makes user use “new threat intelligence” on the previously obtained information to recognize and categorize potential threats before their launching 1,2 …”

“…As a result, taking a proactive approach is generally necessary, like cyber threat hunting. 5 Cyber threat hunting is part of cyber security, which makes user use "new threat intelligence" on the previously obtained information to recognize and categorize potential threats before their launching. 1,2 Cyber security is now utilizing the techniques of artificial intelligence (AI) to defend and mitigate potential cyber threats/attacks.…”

Design and Development of Automated Threat Hunting in Industrial Control Systems

“…Furthermore, the ATT&CK for ICS matrix can help determine what types of data sources are required to detect threats in ICS environments [9] [10] [11]. Threat hunting is a human-based approach, and it is prone to human errors [12] [13] [14]. Therefore, automation of the threat hunting process can help reduce human errors and increase detection speed.…”