Dynamic rule generation for SCADA intrusion detection

Despite the increasing awareness of cyber-attacks against Critical Infrastructure (CI), safeguarding the Supervisory Control and Data Acquisition (SCADA) systems remains inadequate. For this purpose, designing an efficient SCADA Intrusion Detection System (IDS) becomes a significant research topic of the researchers to counter cyber-attacks. Most of the existing works present several statistical and machine learning approaches to prevent the SCADA network from the cyber-attacks. Whereas, these approaches failed to concern the most common challenge, “Curse of dimensionality”. This scenario accentuates the necessity of an efficient feature selection algorithm in SCADA IDS where it identifies the relevant features and eliminates the redundant features without any loss of information. Hence, this paper proposes a novel filter-based feature selection approach for the identification of informative features based on Rough Set Theory and Hyper-clique based Binary Whale Optimization Algorithm (RST-HCBWoA). Experiments were carried out by Power system attack dataset and the performance of RST-HCBWoA was evaluated in terms of reduct size, precision, recall, classification accuracy, and time complexity.

Supervisory Control and Data Acquisition (SCADA) systems play a prominent role in monitoring and controlling the Critical Infrastructures (CIs) such as water distribution, nuclear plants, and chemical industries. On the other hand, SCADA systems are highly exposed to new vulnerabilities as it highly relies on the internet. Machine learning approaches have been employed to detect the cyberattacks injected by the attackers in CIs. However, those approaches failed to protect the CIs against the ever-advancing nature of cyberattacks. This work presents Salp Swarm Optimization-based Isolation Forest (SSO-IF) to build an efficient SCADA intrusion detection system, and the experiments were carried out using power system dataset from Mississippi State University. The performance of SSO-IF was validated over the state-of-the-art intrusion detection techniques in terms of classification accuracy and detection rate.

Supervisory Control and Data Acquisition (SCADA) systems play a significant role in providing remote access, monitoring and control of critical infrastructures (CIs) which includes electrical power systems, water distribution systems, nuclear power plants, etc. The growing interconnectivity, standardization of communication protocols and remote accessibility of modern SCADA systems have contributed massively to the exposure of SCADA systems and CIs to various forms of security challenges. Any form of intrusive action on the SCADA modules and communication networks can create devastating consequences on nations due to their strategic importance to CIs’ operations. Therefore, the prompt and efficient detection and classification of SCADA systems intrusions hold great importance for national CIs operational stability. Due to their well-recognized and documented efficiencies, several literature works have proposed numerous supervised learning techniques for SCADA intrusion detection and classification (IDC). This paper presents a critical review of recent studies whereby supervised learning techniques were modelled for SCADA intrusion solutions. The paper aims to contribute to the state-of-the-art, recognize critical open issues and offer ideas for future studies. The intention is to provide a research-based resource for researchers working on industrial control systems security. The analysis and comparison of different supervised learning techniques for SCADA IDC systems were critically reviewed, in terms of the methodologies, datasets and testbeds used, feature engineering and optimization mechanisms and classification procedures. Finally, we briefly summarized some suggestions and recommendations for future research works.

Securing and protecting Supervisory Control and Data Acquisition (SCADA) systems have been an active topic of research for the past decades due to the catastrophic and disastrous consequences when these systems are breached or compromised. Therefore, possible cyberattacks and malicious behaviours must be addressed instantly to prevent catastrophic and disastrous consequences on the national critical infrastructures. To this end, intrusion detection systems are considered as an essential security defence mechanism for SCADA networks. It can effectively detect potential cyberattacks and malicious activities and prevent catastrophic consequences. However, zero-day, deception and stealth attacks require a special type of detection methods in which it should be able to identify anomalies and detect possible malicious activities. There are a handful number of studies that have been carried out previously in this regard. However, this area of research is still immature and emerging. Therefore, this research is intended to investigate the merits, limitations and drawbacks of the existing detection methods, investigates the cyberattacks on SCADA systems, identify key features that can be used to discover irregular activities and to put forward the requirements and recommendations for detect cyberattacks and malicious activities in the SCADA networks.

This paper discusses the new auspicious trends of internet of things (IoT) and its advanced developments in various sectors of today’s IT arena, including for industrial sectors. Each object acts as a communication node (or entity) that is able to communicate with other nodes, and corresponding information could be accessed and controlled, via several of today’s commonly used electronic devices such as laptops and cellular devices, etc., through an IoT-designed platform. Moreover, in industrial automation sectors, the employment of IoT is very advantageous, in terms of remote communication support; low-cost operations and maintenance; and autonomous collaborations among remote networked field devices, etc. The facility of autonomous collaborations provisioned by IoT, in the context of a supervisory control and data acquisition (SCADA) system as part of an industrial control system, somehow exists in a distributed network protocol (DNP3) during automation and controls. Therefore, the current study takes the step to model a new IoT framework for a SCADA system, which will be efficient at facilitating industrial automation through the collaborative DNP3-Modbus acquisitions and automation, called the SCADA-IoT system. An IoT gateway is employed and configured that supports for both SCADA protocols, such as DNP3 and Modbus and is efficient at communicating, from networked field devices, with inter-processing from both. In the overall SCADA-IoT design, the transmission is carried from an enormous amount of sensors and/or field devices, employing proprietary and nonproprietary protocols; further, sent information is analyzed via big data, stored in a cloud center, monitored and controlled over a SCADA-IoT supportive platform. At the same time, information security (IS) is a big associated challenge and one of the main contributions of this study. Thus, this study also analyzed the potential security mechanisms for securing SCADA-IoT and found cryptography to be a noteworthy security solution, based on the proposed system requirements and its communication demands.

PPFSCADA: Privacy preserving framework for SCADA data publishing

Supervisory Control and Data Acquisition (SCADA) systems play an important role in monitoring industrial processes such as electric power distribution, transport systems, water distribution, and wastewater collection systems. Such systems require a particular attention with regards to security aspects, as they deal with critical infrastructures that are crucial to organizations and countries. Protecting SCADA systems from intrusion is a very challenging task because they do not only inherit traditional IT security threats but they also include additional vulnerabilities related to field components (e.g., cyber-physical attacks). Many of the existing intrusion detection techniques rely on supervised learning that consists of algorithms that are first trained with reference inputs to learn specific information, and then tested on unseen inputs for classification purposes. This article surveys supervised learning from a specific security angle, namely SCADA-based intrusion detection. Based on a systematic review process, existing literature is categorized and evaluated according to SCADA-specific requirements. Additionally, this survey reports on well-known SCADA datasets and testbeds used with machine learning methods. Finally, we present key challenges and our recommendations for using specific supervised methods for SCADA systems.

SCADA (Supervisory Control and Data Acquisition) systems are critical for managing industrial processes, including energy production, manufacturing, and transportation. However, their reliance on protocols such as Modbus, which lack inherent security features, exposes them to sophisticated cyber threats. This paper explores vulnerabilities in the Modbus protocol to design advanced SCADA-specific attack scenarios—SCADA Hijacking and SCADA Blackout. These covert attacks exploit protocol weaknesses to manipulate process parameters or halt operations while evading detection by intrusion detection systems (IDS) and human operators, representing a significant escalation in the sophistication of cyber threats. To counter these threats, we propose a novel machine learning-based defense mechanism that incorporates heterogeneous graph embeddings, combining multimodal network data such as flow-level and packet-level features. The proposed attacks and defense mechanism were rigorously evaluated using precision, recall, F1 score, accuracy and false positive rate as key metrics, demonstrating the stealthiness of the attacks and the robustness of the defense. By exposing critical vulnerabilities and presenting an advanced intrusion detection framework, this research establishes a foundation for strengthening SCADA systems against evolving cyber threats, ensuring the security and reliability of industrial control systems.

Combining ensemble methods and social network metrics for improving accuracy of OCSVM on intrusion detection in SCADA systems

SCADA (supervisory control and data acquisition) systems are used to monitor and control the processes of industrial facilities remotely. The use of standard technologies and interconnections between the systems lead to variety of security attacks. SCADA systems are being the part of many critical applications of the society. Any minute deviation in the normal operation of the system results in serious consequences. Hence, securing the industrial control systems is a high priority issue. One can provide security and safety to the system by identifying possible sources of threats and objectives of attackers and continuous monitoring of the operations of the system. In this paper, attack incidents occurred on command and control systems are presented (from the year 1982 to 2017), the general attacker goals on SCADA systems are discussed, SCADA communication protocols and its normal/abnormal behaviors are analyzed using the Wireshark tool.

Chapter 6 - Protecting Critical Infrastructure: Process Control and SCADA

The convergence of Supervisory Control and Data Acquisition (SCADA) systems with the Internet of Things (IoT) and Machine Learning (ML) is redefining automation, security, and operational efficiency across industries. Traditional SCADA systems, widely used in critical infrastructure such as energy, water management, and industrial processes, are undergoing a transformative shift with the integration of IoT. IoT-enabled sensors and devices provide real-time data streams from diverse operational environments, enabling SCADA systems to achieve enhanced situational awareness and remote monitoring capabilities. Machine Learning further augments SCADA systems by introducing advanced analytics for predictive maintenance and anomaly detection. ML algorithms analyse vast datasets collected through IoT devices to forecast system failures, optimize resource utilization, and ensure uninterrupted operations. This predictive approach minimizes downtime, reduces maintenance costs, and improves overall efficiency. Cloud-driven security frameworks are pivotal in addressing the growing cybersecurity challenges associated with SCADA and IoT integration. These frameworks provide scalable and resilient solutions for protecting data integrity, preventing unauthorized access, and mitigating cyber threats. The deployment of ML-driven cybersecurity solutions enhances the ability to detect and respond to sophisticated attacks targeting SCADA environments. This paper examines the evolution of SCADA systems in the era of IoT, focusing on the transformative role of ML and cloud-driven security. It explores innovative applications, highlights the challenges of integrating these technologies, and provides insights into future advancements for creating robust and secure automated systems.

Cyber-threats are one of the most significant problems faced by modern Industrial Control Systems (ICS), such as SCADA (Supervisory Control and Data Acquisition) systems, as the vulnerabilities of ICS technology become serious threats that can ultimately compromise human lives. This situation demands a domain-specific approach to cyber threat detection within ICS, which is one of the most important contributions of the CockpitCI FP7 project (http://CockpitCI.eu). Specifically, this paper will present the CockpitCI distributed Intrusion Detection System (IDS) for ICS, which provides its core cyber-detection and analysis capabilities, also including a description of its components, in terms of role, operation, integration, and remote management. Moreover, it will also introduce and describe new domain-specific solutions for ICS security such as the SCADA Honeypot and the Shadow Security Unit, which are part of the CockcpitCI IDS framework.

In the modern industrial control landscape, Supervisory Control and Data Acquisition (SCADA) systems serve as critical intermediaries in automating and managing complex processes across many industries, including energy, manufacturing, and utilities. While maintaining the availability and efficiency of these systems is essential, their increased integration into networked environments has exposed them to a growing array of cyber threats. As SCADA systems continue to grow and be deployed globally, malicious actors are increasingly target critical infrastructure, making security management progressively more challenging. Our research explores the benefits of conducting forensic investigations focused on SCADA Human-Machine Interface (HMI) systems, emphasizing how centralized equipment analysis can help overcome the unique challenges these systems present. To assist investigators in efficiently collecting system-wide data from SCADA HMI environments, we developed a forensic analysis framework that enables the evaluation of system discrepancies and evidence of potential cyberattacks. Additionally, we present a comprehensive forensic analysis of a SCADA testbed featuring Ignition, a popular SCADA software platform developed by Inductive Automation. Our investigation reveals that SCADA HMI forensics can provide valuable insight into the system's state, allowing for the identification and cross-analysis of critical equipment and operational data across memory, network, and disk. This framework is further supported by the creation of the Ignition Forensic Artifact Carving Tool (IFACT), a SCADA HMI Forensic Analysis Tool designed to assist in extracting artifacts and parsing system information from forensic data sourced from Ignition HMIs. Using IFACT, we achieve accurate insights into device and equipment data in SCADA systems, investigating data persistence in volatile memory and the variability of its lifetime based on the system state.

The supervisory control and data acquisition (SCADA) systems monitor and control industrial control systems in many industrial and economic sectors such as water treatment, power plants, railroads, and gas pipelines. The integration of SCADA systems with the internet and corporate enterprise networks for various economical reasons exposes SCADA systems to attacks by hackers who could remotely exploit and gain access to SCADA systems to damage the infrastructure and thereby harming people’s lives. The simplicity of datasets and possible overfitting of models to training data are some of the issues in the previous research. In this paper, we present detecting and classifying malicious command and response packets in a SCADA network by analyzing attribute differences and history of packets using k-means clustering. This study presents a solution to classify SCADA cyber attacks to detect and classify SCADA attacks with high accuracy using a big data framework that comprises of Apache Hadoop and Apache Mahout. Apache Mahout’s random forest classification algorithm is applied on SCADA’s gas pipeline dataset to categorize attacks. When 70% of the data is used for training the classifier, our approach resulted in 5–17% improvement in accuracy for the classification of read response attacks and 2–8% improvement in accuracy for write command attacks with respect to using the original dataset.