Stateful intrusion detection for IEC 60870-5-104 SCADA security

Yang, Yi; McLaughlin, Kieran; Sezer, Sakir; Yuan, Yubo; Huang, Wei

doi:10.1109/pesgm.2014.6939218

Cited by 33 publications

(22 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In [127], Y. Yang et al provide a specification-based IDS for the IEC-104 [109] protocol. The core of their system is named Detection State Machine (DSM) and its functionality is based on the Finite State Machines (FSM) methodology.…”

Section: Idps Systems For Scada Systemsmentioning

confidence: 99%

Securing the Smart Grid: A Comprehensive Compilation of Intrusion Detection and Prevention Systems

2019

View full text Add to dashboard Cite

The smart grid (SG) paradigm is the next technological leap of the conventional electrical grid, contributing to the protection of the physical environment and providing multiple advantages such as increased reliability, better service quality, and the efficient utilization of the existing infrastructure and the renewable energy resources. However, despite the fact that it brings beneficial environmental, economic, and social changes, the existence of such a system possesses important security and privacy challenges, since it includes a combination of heterogeneous, co-existing smart, and legacy technologies. Based on the rapid evolution of the cyber-physical systems (CPS), both academia and industry have developed appropriate measures for enhancing the security surface of the SG paradigm using, for example, integrating efficient, lightweight encryption and authorization mechanisms. Nevertheless, these mechanisms may not prevent various security threats, such as denial of service (DoS) attacks that target on the availability of the underlying systems. An efficient countermeasure against several cyberattacks is the intrusion detection and prevention system (IDPS). In this paper, we examine the contribution of the IDPSs in the SG paradigm, providing an analysis of 37 cases. More detailed, these systems can be considered as a secondary defense mechanism, which enhances the cryptographic processes, by timely detecting or/and preventing potential security violations. For instance, if a cyberattack bypasses the essential encryption and authorization mechanisms, then the IDPS systems can act as a secondary protection service, informing the system operator for the presence of the specific attack or enabling appropriate preventive countermeasures. The cases we study focused on the advanced metering infrastructure (AMI), supervisory control and data acquisition (SCADA) systems, substations, and synchrophasors. Based on our comparative analysis, the limitations and the shortcomings of the current IDPS systems are identified, whereas appropriate recommendations are provided for future research efforts.

show abstract

Section: Idps Systems For Scada Systemsmentioning

confidence: 99%

Securing the Smart Grid: A Comprehensive Compilation of Intrusion Detection and Prevention Systems

2019

View full text Add to dashboard Cite

show abstract

“…However, NG-SDH and PDH networks have high Operational Expenditure (OPEX). In addition, the demand for packet technologies is increasing significantly, according to the same reference, such as devices based on IEC 60870 and IEC 61850 remote control (data acquisition and supervision control) standards [153], [187], [188].…”

Section: ) Sdhmentioning

confidence: 99%

Control Networks and Smart Grid Teleprotection: Key Aspects, Technologies, Protocols, and Case-Studies

et al. 2020

View full text Add to dashboard Cite

The appeal for more reliable, efficient and resilient power grids has become indispensable with the recent technological development and ever-increasing demand for electrical energy. These goals might be achieved by introducing sensors and actuators in the power grid, with the purpose of enabling a smart control of the power network. All power devices must be connected using a reliable communication network, which should be able to operate even when the power grid fails. Currently, several communication technologies have been applied for supporting this new application scenario. This paper aims for reviewing both academic and market use cases for technologies applied to the mission-critical, control networks and Smart Grid applications, such as teleprotection, self-healing, communication with control centers and field devices, among others. More specifically, the key aspects, potential technologies, main protocols and use cases of operating data networks in energy transmission, power distribution and smart grid environments, including circuit and packet switching technologies, are discussed into details. Furthermore, resilience and the main telecommunications technologies used in power grids, as well, the correlation among them, are exploited in practical point of view. The article provides a broad discussion on the best telecommunication options to build the emerging intelligent energy distribution systems, covering control networks, teleprotection, and smart grid applications.

show abstract

“…This work has been extended by the authors of [14] for IEC/ 60870-5-104 protocols by deriving stateful protocol analysis approach [105]. Stateful analysis compares predetermined acceptable protocol behaviours against observed activities to detect deviations or intrusions.…”

Section: Network Intrusion Detection Systems (Ids)mentioning

confidence: 99%

Assessing and augmenting SCADA cyber security: A survey of techniques

Nazir

Patel

2017

Computers & Security

148

View full text Add to dashboard Cite

SCADA systems monitor and control critical infrastructures of national importance such as power generation and distribution, water supply, transportation networks, and manufacturing facilities. The pervasiveness, miniaturisations and declining costs of internet connectivity have transformed these systems from strictly isolated to highly interconnected networks. The connectivity provides immense benefits such as reliability, scalability and remote connectivity, but at the same time exposes an otherwise isolated and secure system, to global cyber security threats. This inevitable transformation to highly connected systems thus necessitates effective security safeguards to be in place as any compromise or downtime of SCADA systems can have severe economic, safety and security ramifications. One way to ensure vital asset protection is to adopt a viewpoint similar to an attacker to determine weaknesses and loopholes in defences. Such mind sets help to identify and fix potential breaches before their exploitation. This paper surveys tools and techniques to uncover SCADA system vulnerabilities. A comprehensive review of the selected approaches is provided along with their applicability.

show abstract

Stateful intrusion detection for IEC 60870-5-104 SCADA security

Cited by 33 publications

References 12 publications

Securing the Smart Grid: A Comprehensive Compilation of Intrusion Detection and Prevention Systems

Securing the Smart Grid: A Comprehensive Compilation of Intrusion Detection and Prevention Systems

Control Networks and Smart Grid Teleprotection: Key Aspects, Technologies, Protocols, and Case-Studies

Assessing and augmenting SCADA cyber security: A survey of techniques

Contact Info

Product

Resources

About