Using a packet manipulation tool for security analysis of industrial network protocols

Kobayashi, Tiago H.; Batista, Aguinaldo B.; Brito, Agostinho M.; Pires, Paulo F.

doi:10.1109/efta.2007.4416847

Cited by 26 publications

(8 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…We captured three days of network traffic: 2-day data were used to construct the user behavior model, and 1-day data was used for testing. Because the BUCT dataset does not consist of anomaly traffic, we used the Scapy [27] to generate SYN-flood attacks traffic for the BUCT dataset. The Scapy is a powerful Python-based interactive packet manipulation program and library.…”

Section: Datasetsmentioning

confidence: 99%

Network Anomaly Detection by Using a Time-Decay Closed Frequent Pattern

Zhao

Chen

et al. 2019

Information

View full text Add to dashboard Cite

Anomaly detection of network traffic flows is a non-trivial problem in the field of network security due to the complexity of network traffic. However, most machine learning-based detection methods focus on network anomaly detection but ignore the user anomaly behavior detection. In real scenarios, the anomaly network behavior may harm the user interests. In this paper, we propose an anomaly detection model based on time-decay closed frequent patterns to address this problem. The model mines closed frequent patterns from the network traffic of each user and uses a time-decay factor to distinguish the weight of current and historical network traffic. Because of the dynamic nature of user network behavior, a detection model update strategy is provided in the anomaly detection framework. Additionally, the closed frequent patterns can provide interpretable explanations for anomalies. Experimental results show that the proposed method can detect user behavior anomaly, and the network anomaly detection performance achieved by the proposed method is similar to the state-of-the-art methods and significantly better than the baseline methods.

show abstract

Section: Datasetsmentioning

confidence: 99%

Network Anomaly Detection by Using a Time-Decay Closed Frequent Pattern

Zhao

Chen

et al. 2019

Information

View full text Add to dashboard Cite

show abstract

“…Their security framework consists of four components, namely monitoring, anomaly detection, impact analysis and mitigation strategies. Similarly, packet manipulation software Scapy is used in [5] to perform vulnerability testing on Modbus/TCP. Cyber security issues and access points in a substation have been highlighted in [3] and [9].…”

Section: Related Workmentioning

confidence: 99%

SCADA security device

Rodrigues¹,

Best²,

Pendse³

2011

Proceedings of the Seventh Annual Workshop on Cyber Security and Information Intelligence Research

View full text Add to dashboard Cite

Securing SCADA systems is a critical aspect of Smartgrid security. As sophisticated attacks continue to target industrial systems, the focus should be on planning and developing new security techniques that will adapt to the SCADA environment and protocols. Traditional SCADA protocols such as DNP3, Modbus and ICCP do not support encryption, authentication and data integrity in their native form. Although they can be secured with VPN tunnels, IPSEC adds significant network overhead and complexity to the end hosts. SCADA devices may lack the computing resources to implement this kind of technique. In this paper, we propose a security design that can help make communications between the master stations and slave devices in a SCADA network secure without putting additional overhead on the remote devices. This research designs a SCADA Security Device (SSD) which can work in conjunction with other network elements to implement a secure architecture for SCADA protocols. Several components of the SSD were implemented and tested during this research to evaluate the security features in a SCADA network.

show abstract

“…This is partly caused by the sensitivity of the data. In fact, publications on SCADA networks generally do not rely on empirical data as obtained from real-world measurement [1,2,3]. In contrast, traditional networks have been intensively studied, sometimes leading to surprising insights.…”

Section: Introductionmentioning

confidence: 99%

Difficulties in Modeling SCADA Traffic: A Comparative Analysis

Barbosa

Sadre

Pras

2012

Passive and Active Measurement

View full text Add to dashboard Cite

Abstract. Modern critical infrastructures, such as water distribution and power generation, are large facilities that are distributed over large geographical areas. Supervisory Control and Data Acquisition (SCADA) networks are deployed to guarantee the correct operation and safety of these infrastructures. In this paper, we describe key characteristics of SCADA traffic, verifying if models developed for traffic in traditional IT networks are applicable. Our results show that SCADA traffic largely differs from traditional IT traffic, more noticeably not presenting diurnal patters or self-similar correlations in the time series.

show abstract

Using a packet manipulation tool for security analysis of industrial network protocols

Cited by 26 publications

References 3 publications

Network Anomaly Detection by Using a Time-Decay Closed Frequent Pattern

Network Anomaly Detection by Using a Time-Decay Closed Frequent Pattern

SCADA security device

Difficulties in Modeling SCADA Traffic: A Comparative Analysis

Contact Info

Product

Resources

About