A Distributed IDS for Industrial Control Systems

SCADA (Supervisory Control and Data Acquisition) systems are critical for managing industrial processes, including energy production, manufacturing, and transportation. However, their reliance on protocols such as Modbus, which lack inherent security features, exposes them to sophisticated cyber threats. This paper explores vulnerabilities in the Modbus protocol to design advanced SCADA-specific attack scenarios—SCADA Hijacking and SCADA Blackout. These covert attacks exploit protocol weaknesses to manipulate process parameters or halt operations while evading detection by intrusion detection systems (IDS) and human operators, representing a significant escalation in the sophistication of cyber threats. To counter these threats, we propose a novel machine learning-based defense mechanism that incorporates heterogeneous graph embeddings, combining multimodal network data such as flow-level and packet-level features. The proposed attacks and defense mechanism were rigorously evaluated using precision, recall, F1 score, accuracy and false positive rate as key metrics, demonstrating the stealthiness of the attacks and the robustness of the defense. By exposing critical vulnerabilities and presenting an advanced intrusion detection framework, this research establishes a foundation for strengthening SCADA systems against evolving cyber threats, ensuring the security and reliability of industrial control systems.

SCADA (supervisory control and data acquisition) systems are used to monitor and control the processes of industrial facilities remotely. The use of standard technologies and interconnections between the systems lead to variety of security attacks. SCADA systems are being the part of many critical applications of the society. Any minute deviation in the normal operation of the system results in serious consequences. Hence, securing the industrial control systems is a high priority issue. One can provide security and safety to the system by identifying possible sources of threats and objectives of attackers and continuous monitoring of the operations of the system. In this paper, attack incidents occurred on command and control systems are presented (from the year 1982 to 2017), the general attacker goals on SCADA systems are discussed, SCADA communication protocols and its normal/abnormal behaviors are analyzed using the Wireshark tool.

Ransomware is a malware type whose purpose is to lock and deny access to vital resources and services in the system. Like any other system, ransomware targets Supervisory Control and Data Acquisition (SCADA) and denies access to many components and data these systems collect. This represents a major threat to the systems that rely on SCADA to control the operational process. Although several studies have been conducted to address the issue of ransomware and mitigate the effect of its attacks, they approach the problem from the traditional systems perspective. That is, these solutions treat the ransomware attack on SCADA systems similar to those attacking conventional systems. This is not realistic because of the unique characteristics of SCADA systems, which are reflected in the nature and capability of ransomware attacks. Not only are data stored in SCADA nodes vulnerable to the ransomware attack, but also the data collected and shared with the other nodes. As such, traditional measures for ransomware detection become unable to deal with the attack as they assume that ransomware attacks the data at rest only. In SCADA systems, the attack model, success factors, and infection vectors of ransomware attacks are different. As such it is important to explore and understand the unique characteristics of ransomware that target SCADA systems as a prerequisite to thwart it. Therefore, this study is devoted to investigating the unique characteristics and main factors for successful ransomware attacks.

<p>Modern Industrial Control System (ICS) can provide vast functions as the introduction of IT technology is established along with the introduction of the IoT environment. Engineering Workstation (EWS) used by ICS is widely used to efficiently manage and control industrial devices including smart IoT devices. However, the DLL injection attack in ICS is not high in difficulty compared to the risk, but it can cause fatal malfunction. If an attack is carried out targeting the EWS, it may cause erroneous operation in many control devices, including IoT devices, cause fatal accidents throughout the Supervisory Control and Data Acquisition (SCADA) system. In this paper, we present a method to detect DLL injection attacks by specializing in EWS used in ICS in IoT environment and purpose a method to detect data changes due to DLL injection attacks by analyzing and utilizing PEB-LDR data. Also, we purpose a method to detect and block execution when a malicious DLL is suspected to be loaded by DLL injection.</p> <p> </p>

The advanced connection requirements of industrial automation and control systems have sparked a new revolution in the Industrial Internet of Things (IIoT), and the Supervisory Control and Data Acquisition (SCADA) network has evolved into an open and highly interconnected network. In addition, the equipment of industrial electronic devices has experienced complete systemic integration by connecting with the SCADA network, and due to the control and monitoring advantages of SCADA, the interconnectivity and working efficiency among systems have been tremendously improved. However, it is inevitable that the SCADA system cannot be separated from the public network, which indicates that there are concerns over cyber-attacks and cyber-threats, as well as information security breaches, in the SCADA network system. According to this context, this paper proposes a module based on the token authentication service to deter attackers from performing distributed denial-of-service (DDoS) attacks. Moreover, a simulated experiment has been conducted in an energy management system in the actual field, and the experimental results have suggested that the security defense architecture proposed by this paper can effectively improve security and is compatible with real field systems.

In view of the insufficient informationization of the stainless steel pipe production line., such as the inability to collect the machine tool's processing data in real time, the inaccurate production information feedback, and the insufficient monitoring of the equipment status, a SCADA (Supervisory Control And Data Acquisition) system is designed to effectively control and monitor the entire stainless steel pipe production line to achieve the information construction of the factory. Siemens S7-1500 series PLC is used as the lower computer of this system, and communicates with the upper computer software through Siemens S7 protocol. The SCADA system is developed in C# language, and its functions include equipment status monitoring, production process monitoring, production statistical analysis and electronic board display. The SCADA system can realize the automation of data collection, data processing and data analysis, which improves the production efficiency and management level of the production line.

Supervisory Control and Data Acquisition (SCADA) is used in modern power system for monitoring, controlling, gathering the information, transfer to information back to a central station, carry out necessary analysis and control carry out necessary analysis and control. A SCADA system involves the integrated technologies of computer, communication, electric devices etc. Here the communication media provides the physical medium for transferring, controlling and acquisition of data within SCADA from remote locations. Although wireless communications media become an attractive option as communications networks for SCADA system, compared with wired communications, wireless communications in power system environments presents a number of security and reliability issues. As in SCADA system the communication media plays an important role, to meet objectives of the SCADA systems, different wired and wireless communications media have been applied in modern power system environment. This paper presents a concept about SCADA system using Cognitive Radio based IEEE 802.22 standard for overcoming all existing limitations of SCADA's communication media for future power system where details design, analyses of feasibility and benefits over wired and other wireless systems are also described.

Supervisory control and data acquisition (SCADA) and industrial control systems monitor and control a wide range of industrial and infrastructure processes such as manufacturing production lines, water treatment, fuel production and electricity distribution. Such systems are usually built using a variety of commodity computer and networking components, and are becoming increasingly interconnected with corporate and other Internet-visible networks. As a result, they face significant threats from internal and external actors. For example, the now famous Stuxnet (which is a Windowsspecific computer worm containing a rootkit and four zero-day attacks) was specifically written to attack SCADA systems that alone caused multi-million dollars damages in 2010. 2011 and 2012 have seen additional increases in vulnerability disclosures in SCADA and industrial control systems, further increasing the urgency of finding effective and cost efficient security measures.

This paper proposes an intelligent gateway system for SCADA networks to avoid DOS attacks. The proposed approach provides details about an SIG system architecture which establishes the connection between Master SIGs and Perimeter SIGs, the traffic flow, major alerts, and minor alerts. Simulation experiments are an indispensable phase to analyze and assess the security of SCADA (Supervisory Control and Data Acquisition) systems. Although numerous experiments have taken place, limitations are still not been shrunk. The SCADA Intelligence Gateway concept proposed in this paper is experimentally proved and showed its ability to secure the SCADA system from attacks. The intelligence learning mechanism established the ability to identify malicious traffic through bot production and simulation environments.

The SCADA system applications in management of Yuvacik Dam and Reservoir

Most of the machinery and equipment of the mine infrastructure is controlled by an industrial automation system. In practice, SCADA (Supervisory Control And Data Acquisition) systems very often acquire many operational parameters that have no further analytical use. The variability of recorded signals very often depends on the machine load, as well as organizational and technical aspects. Therefore, SCADA systems can be a practically free source of information used to determine KPI (e.g. performance, energy and diagnostic) for a single object as well as given mining process. For example, the ability to reliably identify different operational modes of the mining industrial fans based on data from SCADA gives a wide range of potential applications. Accurate information on this subject could be used - apart from basic monitoring and reporting needs (e.g. actual work vs. schedule comparison) – also in more complex problems, like power consumption predictions. Given the variety of industrial fans used in the mining industry and the different operational data collected, this is yet not a trivial task in a general case. The main aim of this article is to provide reliable algorithms solving fans operational mode identification issue, which will be possible to apply in a wide range of potential applications.

The supervisory control and data acquisition (SCADA) systems monitor and control industrial control systems in many industrial and economic sectors such as water treatment, power plants, railroads, and gas pipelines. The integration of SCADA systems with the internet and corporate enterprise networks for various economical reasons exposes SCADA systems to attacks by hackers who could remotely exploit and gain access to SCADA systems to damage the infrastructure and thereby harming people’s lives. The simplicity of datasets and possible overfitting of models to training data are some of the issues in the previous research. In this paper, we present detecting and classifying malicious command and response packets in a SCADA network by analyzing attribute differences and history of packets using k-means clustering. This study presents a solution to classify SCADA cyber attacks to detect and classify SCADA attacks with high accuracy using a big data framework that comprises of Apache Hadoop and Apache Mahout. Apache Mahout’s random forest classification algorithm is applied on SCADA’s gas pipeline dataset to categorize attacks. When 70% of the data is used for training the classifier, our approach resulted in 5–17% improvement in accuracy for the classification of read response attacks and 2–8% improvement in accuracy for write command attacks with respect to using the original dataset.

Securing and protecting Supervisory Control and Data Acquisition (SCADA) systems have been an active topic of research for the past decades due to the catastrophic and disastrous consequences when these systems are breached or compromised. Therefore, possible cyberattacks and malicious behaviours must be addressed instantly to prevent catastrophic and disastrous consequences on the national critical infrastructures. To this end, intrusion detection systems are considered as an essential security defence mechanism for SCADA networks. It can effectively detect potential cyberattacks and malicious activities and prevent catastrophic consequences. However, zero-day, deception and stealth attacks require a special type of detection methods in which it should be able to identify anomalies and detect possible malicious activities. There are a handful number of studies that have been carried out previously in this regard. However, this area of research is still immature and emerging. Therefore, this research is intended to investigate the merits, limitations and drawbacks of the existing detection methods, investigates the cyberattacks on SCADA systems, identify key features that can be used to discover irregular activities and to put forward the requirements and recommendations for detect cyberattacks and malicious activities in the SCADA networks.

Supervisory Control and Data Acquisition (SCADA) systems play a significant role in providing remote access, monitoring and control of critical infrastructures (CIs) which includes electrical power systems, water distribution systems, nuclear power plants, etc. The growing interconnectivity, standardization of communication protocols and remote accessibility of modern SCADA systems have contributed massively to the exposure of SCADA systems and CIs to various forms of security challenges. Any form of intrusive action on the SCADA modules and communication networks can create devastating consequences on nations due to their strategic importance to CIs’ operations. Therefore, the prompt and efficient detection and classification of SCADA systems intrusions hold great importance for national CIs operational stability. Due to their well-recognized and documented efficiencies, several literature works have proposed numerous supervised learning techniques for SCADA intrusion detection and classification (IDC). This paper presents a critical review of recent studies whereby supervised learning techniques were modelled for SCADA intrusion solutions. The paper aims to contribute to the state-of-the-art, recognize critical open issues and offer ideas for future studies. The intention is to provide a research-based resource for researchers working on industrial control systems security. The analysis and comparison of different supervised learning techniques for SCADA IDC systems were critically reviewed, in terms of the methodologies, datasets and testbeds used, feature engineering and optimization mechanisms and classification procedures. Finally, we briefly summarized some suggestions and recommendations for future research works.

Abstract: In the oil and gas sector, supervisory control and data acquisition (SCADA) systems have become a revolutionary force that are transforming operations throughout the whole value chain. This in-depth analysis looks at the development, design, and various uses of SCADA systems in the upstream, middle, and downstream domains. It projects that the global SCADA market for oil and gas will grow to $4.52 billion by 2026. Real-time well monitoring, production optimization, and remote operations are made possible by SCADA systems in upstream operations, which greatly increase output and efficiency. The goal of midstream applications is to increase pipeline efficiency and safety by using predictive maintenance, enhanced leak detection, and flow optimization. By streamlining quality assurance, energy management, and process control, SCADA systems can completely transform refinery operations. SCADA deployments are not without difficulties, though, including data management complications, cybersecurity threats, and legacy system interoperability. In addition to addressing these problems, the study looks at new developments that could improve SCADA capabilities, such as edge computing, digital twins, AI and machine learning integration, and 5G technology. According to the research, SCADA is essential for promoting efficiency, safety, and innovation in the oil and gas industry. Businesses that successfully integrate SCADA technologies while overcoming implementation obstacles will be best positioned to prosper in the complicated and fiercely competitive energy market.