Leveraging Semantics for Actionable Intrusion Detection in Building Automation Systems

Fauri, Davide; Kapsalakis, Michail; Santos, Daniel Rodrigues dos; Costante, Elisa; Hartog, Jerry den; Etalle, Sandro

doi:10.1007/978-3-030-05849-4_9

Cited by 8 publications

(3 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Later, Esquivel-Vargas et al [43] test such an IDS in A Data Communication Protocol for Building Automation and Control Networks (BACnet). Some research efforts [48,47] have been made on combining the information extracted from specifications and information learnt from network traffic as well. This movement makes the distinction between learning and specification approaches less rigid.…”

Section: Specification Approachesmentioning

confidence: 99%

Network-based Anomaly Detection for SCADA Systems : Traffic Generation and Modeling

Lin

2022

Linköping Studies in Science and Technology. Dissertations

View full text Add to dashboard Cite

Supervisory Control and Data Acquisition (SCADA) systems control and monitor critical infrastructure in society, such as electricity transmission and distribution systems. Modern SCADA systems are increasingly adopting open standards and being connected to the Internet to enable remote control. A boost in sophisticated attacks against SCADA systems makes SCADA security a pressing issue. An Intrusion Detection System (IDS) is a security countermeasure that monitors a network and tracks unauthenticated activities inside the network. Most commercial IDSs used in general IT systems are signature-based, by which an IDS compares the system behaviors with known attack patterns. Unfortunately, recent attacks against SCADA systems exploit zero-day vulnerabilities which are undetectable by signature-based IDSs.This thesis aims to enhance SCADA system monitoring by network-based anomaly detection that models normal behaviors and finds deviations from the model. With network-based anomaly detection, zero-day attacks are possible to detect. There are two main challenges for network-based anomaly detection. The first challenge is the potentially large number of false positives coming from benign traffic that just deviates from the trained model due to the noises. To address this challenge, this thesis proposes several traffic modeling approaches based on statistics and machine learning techniques for the regular communication patterns in SCADA traffic. The second challenge is the lack of open datasets to evaluate the proposed approaches. Consequently, this thesis proposes a traffic generation framework.Thanks to Jonas Almroth, Erik Westring, and Peter Andersson in FOI and other industrial partners for helping with data collection and providing another point of view. Thanks the Swedish Civil Contingencies Agency (MSB) for financing the studies in this thesis within the Resilient Control and Information Systems (www.rics.se) project. I'm also grateful to all the PhD students, external experts, and professors that I have met within RICS project and SWITS association for the inspiring discussions and comments.Special thanks to all the administrative personnel. Thanks to Anne Moe for her compassionate support and assistance from onboarding to completion of thesis defense. I would also like to express my gratitude to former and current administrative members in the division, Eva Pelayo Danils, Åsa Kärrman, Lene Rosell, for their contributions to an efficient working environment for all of us in RTSLab and IDA.I would like to thank all the former and current members of RTSLab for contributing to an enjoyable and inspiring working environment. I appreciate their valuable input to my research and presentations during the RTS meetings or fikas. Thanks to my lunch companions for providing relaxing breaks that are full of fun and useful life experiences.Finally, I would like to express special thanks to my family and friends for encouragement and support in the past years. I would not have been able to get through the tough times without ...

show abstract

Section: Specification Approachesmentioning

confidence: 99%

Network-based Anomaly Detection for SCADA Systems : Traffic Generation and Modeling

Lin

2022

Linköping Studies in Science and Technology. Dissertations

View full text Add to dashboard Cite

show abstract

“…Risks are then used as an input to establish contingency plans and to decide on improvement strategies. On the other hand, the increasing interest in monitoring tools for BACSs might lead to an overwhelming number of alerts that must be managed by building administrators [11,12]. In this regard, from the reactive perspective, the impact measurement can be used to prioritize failure and security alerts, which helps to efficiently allocate resources to solve the problems.…”

Section: Introductionmentioning

confidence: 99%

BACRank: Ranking Building Automation and Control System Components by Business Continuity Impact

Esquivel-Vargas

Caselli

Tews

et al. 2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Organizations increasingly depend on Building Automation and Control Systems (BACSs) to support their daily tasks and to comply with laws and regulations. However, BACSs are prone to disruptions caused by failures or active attacks. Given the role BACSs play in critical locations such as airports and hospitals, a comprehensive impact assessment methodology is required that estimates the effect of unavailable components in the system. In this paper, we present the foundations of the first impact assessment methodology for BACSs focused on business continuity. At the core of our methodology, we introduce a novel graph centrality measure called BACRank. We quantify the contribution of BACS components to different business activities. Moreover, we take functional dependencies among components into account to estimate indirect consequences throughout the infrastructure. We show the practical applicability of our approach on a real BACS deployed at a 5-story building hosting 375 employees on an international university campus. The experimental evaluation confirms that the proposed methodology successfully prioritizes the most relevant components of the system with respect to the business continuity perspective.

show abstract

“…In the IT domain, it is estimated that attacks could be prevented with only one fifth of the overall cost of dealing with the attack [88]. While most security research in the smart buildings domain focuses on attack detection [29,43,44,105,132,144], there is a gap with respect to attack prevention controls.…”

Section: Motivationmentioning

confidence: 99%

Towards automated identification and assessment of security weaknesses in smart buildings

Esquivel-Vargas¹

View full text Add to dashboard Cite

A mamá.I started my study-abroad adventure in the autumn of 2014. Back then I was not even used to split time in seasons other than dry and rainy. In any case, this was the least of all changes in my life. My plan was very simple: to start a specialization in cybersecurity with a masters program followed by a PhD track. But life also had plans for me.This journey allowed me to meet many kind and smart people.• To my supervision team: Andreas, Marco, and Pieter, you taught me to do research, to look at problems from different angles, and to pay special attention to the details at work. Thank you for your patience and support. I feel extremely lucky to have had you as my mentors. Andreas, besides your exceptional academic guidance you were always there to lend an empathetic ear when I needed it. I learned so much from you. Thank you very much. Marco, during your last months at the UT you introduced me to the topic of cyber-physical systems security. Back then it was something new to me that ended up fascinating me. Thanks a lot for staying along the way. Pieter, I got here in the first place because you and Raymond decided to give me the chance to enroll in the Kerckhoffs program. You triggered it all. Thank you very much for the opportunity.• To my fellow PhD/Postdoc students: Ali, Amina, Bence, Philipp, Riccardo, Roeland, Thijs, Tim, Valeriu, and Yoep, it was very fun to work with all of you, not to mention the occasional bitterballen, chess/board games, and joyful coffee breaks. I'm gonna miss the Twente Hacking Squad meetings and the CTF weekends. I would also like to thank Asbat, Chakshu

show abstract

Leveraging Semantics for Actionable Intrusion Detection in Building Automation Systems

Cited by 8 publications

References 16 publications

Network-based Anomaly Detection for SCADA Systems : Traffic Generation and Modeling

Network-based Anomaly Detection for SCADA Systems : Traffic Generation and Modeling

BACRank: Ranking Building Automation and Control System Components by Business Continuity Impact

Towards automated identification and assessment of security weaknesses in smart buildings

Contact Info

Product

Resources

About