Whitelists Based Multiple Filtering Techniques in SCADA Sensor Networks

Kang, Dong-Ho; Kim, Byoungkoo; Na, Jung-Chan; Jhang, Kyoung-Son

doi:10.1155/2014/597697

Cited by 12 publications

(4 citation statements)

References 18 publications

(16 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Eventually, the direction of the stated technological improvements led the industry to form an automation system that communicates using Ethernet or Ethernet-based protocols, contains configured IT services (web, ftp, mail, etc. ), integrates with TCP/IP infrastructure, and is monitored/controlled through SCADA software [2]. Thus, even a terminal device in the field can be controlled directly or indirectly via Ethernet.…”

Section: Introductionmentioning

confidence: 99%

Development of the ECAT Preprocessor with the Trust Communication Approach

Akpinar

Özçeli̇k

2018

Security and Communication Networks

View full text Add to dashboard Cite

In the past several years, attacks over industrial control systems (ICS) have become increasingly frequent and sophisticated. The most common objectives of these types of attacks are controlling/monitoring the physical process, manipulating programmable controllers, or affecting the integrity of software and networking equipment. As one of the widely applied protocols in the ICS world, EtherCAT is an Ethernet-based protocol; thus, it is exposed to both TCP/IP and ICS-specific attacks. In this paper, we analyze EtherCAT field-level communication principles from the security viewpoint focusing on the protocol vulnerabilities, which have been rarely analyzed previously. Our research showed that it lacks the most common security parameters, such as authentication, encryption, and authorization, and is open to Media Access Control (MAC) spoofing, data injection, and other advanced attacks, which require superior skills. To prevent, detect, and reduce attacks over the EtherCAT-based critical systems, first, we improved the open-source Snort intrusion detection/prevention system (IDS/IPS) to support packets that are not processed over transport and network layers. Second, by incorporating a vulnerability analysis, we proposed the EtherCAT (ECAT) preprocessor. Third, we introduced a novel approach called trust-node identification and applied the approach as three rules into the preprocessor. In this sense, the ECAT preprocessor differs from other supported ICS preprocessors in the literature, such as DNP3 and Modbus/TCP. Besides supporting traditional rule expansion, it is also able to handle layer 2 packets and to apply deep packet inspection on EtherCAT packets using the trust-node approach. This method first identifies engineering-station approved nodes based on EtherCAT network information (ENI) configuration files and then deeply inspects incoming packets, considering protocol specifications. The improvements and approach have been tested on the physically developed testbed environment and we have proved that proposals can detect related attacks and provide a basic level of security over the EtherCAT-implemented systems.

show abstract

Section: Introductionmentioning

confidence: 99%

Development of the ECAT Preprocessor with the Trust Communication Approach

Akpinar

Özçeli̇k

2018

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…A DFA is described by five components [25], denoted by a set of five symbols called 5-tuples (Q, ∑, δ, q 0 , F).…”

Section: Deterministic Finite Automatonmentioning

confidence: 99%

Anomaly Detection in Cyclic Communication in OT Protocols

et al. 2022

View full text Add to dashboard Cite

This paper demonstrates the effectiveness of using anomaly detection in cyclic communication as a method aimed at protecting industrial installations from steganographic communication and a wide range of cyberattacks. The analysis was performed for a method based on deterministic finite automaton and the authors’ method using cycles. In this paper, we discuss the cycle detection algorithm and graph construction as well as demonstrate an anomaly detection method for cyberattack detection that utilizes stochastic elements, such as time-to-response and time-between-messages. We present a novel algorithm that combines finite automaton determinism modeling consecutive admissible messages with a time-domain model allowing for random deviations of regularity. The study was conducted for several test scenarios, including C&C steganographic channels generated using the Modbus TCP/IP protocol. Experimental results demonstrating the effectiveness of the algorithms are presented for both methods. All algorithms described in this paper are implemented and run as part of a passive warden system embedded in a bigger commercial IDS (intrusion detection system).

show abstract

“…The work of Kang [100] demonstrated a number of techniques for preventing infected traffic from attacking SCADA protocols. Dubbed the IndusCAP-Gate system, it automatically generates whitelists by analyzing traffic and performing multiple filtering based up said lists for blocking suspected traffic [100]. Multiple filters are a series of four filters for analyzing data packets, checking policy adherence in the packets and access control.…”

Section: Industrial Protocol Filtersmentioning

confidence: 99%

Smart Grid Cyber Security: An Overview of Threats and Countermeasures

López¹,

Sargolzaei²,

Santana³

et al. 2015

JEPE

View full text Add to dashboard Cite

Abstract:The smart grid is the next generation of power and distribution systems. The integration of advanced network, communications, and computing techniques allows for the enhancement of efficiency and reliability. The smart grid interconnects the flow of information via the power line, intelligent metering, renewable and distributed energy systems, and a monitoring and controlling infrastructure. For all the advantages that these components come with, they remain at risk to a spectrum of physical and digital attacks. This paper will focus on digital vulnerabilities within the smart grid and how they may be exploited to form full fledged attacks on the system. A number of countermeasures and solutions from the literature will also be reported, to give an overview of the options for dealing with such problems. This paper serves as a triggering point for future research into smart grid cyber security.

show abstract

Whitelists Based Multiple Filtering Techniques in SCADA Sensor Networks

Cited by 12 publications

References 18 publications

Development of the ECAT Preprocessor with the Trust Communication Approach

Development of the ECAT Preprocessor with the Trust Communication Approach

Anomaly Detection in Cyclic Communication in OT Protocols

Smart Grid Cyber Security: An Overview of Threats and Countermeasures

Contact Info

Product

Resources

About