Integrated Probabilistic Relevancy Classification (PRC) Scheme for Intrusion Detection in SCADA Network

Securing and protecting Supervisory Control and Data Acquisition (SCADA) systems have been an active topic of research for the past decades due to the catastrophic and disastrous consequences when these systems are breached or compromised. Therefore, possible cyberattacks and malicious behaviours must be addressed instantly to prevent catastrophic and disastrous consequences on the national critical infrastructures. To this end, intrusion detection systems are considered as an essential security defence mechanism for SCADA networks. It can effectively detect potential cyberattacks and malicious activities and prevent catastrophic consequences. However, zero-day, deception and stealth attacks require a special type of detection methods in which it should be able to identify anomalies and detect possible malicious activities. There are a handful number of studies that have been carried out previously in this regard. However, this area of research is still immature and emerging. Therefore, this research is intended to investigate the merits, limitations and drawbacks of the existing detection methods, investigates the cyberattacks on SCADA systems, identify key features that can be used to discover irregular activities and to put forward the requirements and recommendations for detect cyberattacks and malicious activities in the SCADA networks.

SCADA (Supervisory Control and Data Acquisition), these are systems based on real-time processing, control and design for real time infrastructure such as water pumping stations, oil purification plants and rail control centers etc. In the initial structure of SCADA there is no security mechanism that prevents or detects the attacks in SCADA communication network. SCADA technology is not new but was deployed in limited networks; currently these systems have been deployed and accessible by many networks such as LAN/WAN, Mobile networks, Web Browsers and GPRS through internet technology. Using Modern communication facilities SCADA systems are vulnerable from different types of internet attacks that create major security problems for SCADA communication. The current paper proposes cryptography solutions for securing SCADA communication. In first part, we propose Cryptography solution using Advance Encryption Standard (AES) and SHA-1 algorithms to secure each end of SCADA communication by implementing security services such as authentication, integrity, and confidentiality In Second part, we propose hybrid cryptography solution for SCADA and give solution to prevent the major attacks that in- Securing the SCADA communication. Hybrid Cryptography Secure Simulation Model is used to discuss and give solutions for putting security services such as authentication, integrity, confidentiality, and non-repudiation in APDU (Application Protocol Data Unit) and LPDU (Link Protocol Data Unit) within SCADA DNP3 protocol, and Rest of paper provide solutions to overcome/prevent attacks such as Guessing Shared Key, Brute force from Authentication; Eavesdropping, Key Cracking, Man in the Middle from Confidentiality; Frame Injection, Data Replay, Data Deletion from Integrity. We use DNP3Sec as framework. Current paper gives research Directions and methods to more secure real time systems.

The supervisory control and data acquisition (SCADA) systems monitor and control industrial control systems in many industrial and economic sectors such as water treatment, power plants, railroads, and gas pipelines. The integration of SCADA systems with the internet and corporate enterprise networks for various economical reasons exposes SCADA systems to attacks by hackers who could remotely exploit and gain access to SCADA systems to damage the infrastructure and thereby harming people’s lives. The simplicity of datasets and possible overfitting of models to training data are some of the issues in the previous research. In this paper, we present detecting and classifying malicious command and response packets in a SCADA network by analyzing attribute differences and history of packets using k-means clustering. This study presents a solution to classify SCADA cyber attacks to detect and classify SCADA attacks with high accuracy using a big data framework that comprises of Apache Hadoop and Apache Mahout. Apache Mahout’s random forest classification algorithm is applied on SCADA’s gas pipeline dataset to categorize attacks. When 70% of the data is used for training the classifier, our approach resulted in 5–17% improvement in accuracy for the classification of read response attacks and 2–8% improvement in accuracy for write command attacks with respect to using the original dataset.

A novel approach of interdependency modeling of Smart Grid and Supervisory Control and Data Acquisition (SCADA) networks is introduced. Methodological approach for vulnerability reduction considering both structural and functional vulnerability is introduced in this paper. The analysis of cyber-attacks on Smart Grid and SCADA network is discussed. Paper discusses importance and need of clean, sustainable and green energy for the future. Paper also analyzes interdependent Smart Grid and SCADA network under severe emergency situations. The contribution of this paper provides novel network with integrated infrastructures for active and survivable network operation. Thus novel Smart Grid and SCADA interdependency network will act as future's clean, sustainable and Green energy model.

The importance of communication security is increased in the power industry, The representative communication network of power industry is the SCADA (Supervisory Control and Data Acquisition) systems. The SCADA system has been used for remote measurement and control in the power industry, Recently, many studies of SCADA network security have been carried out around the world In this paper, we introduce recent security issues in the SCADA network and propose the application of a symmetric encryption method to the Korea SCADA network.

Active worms are capable of compromising the cyber security of the supervisory control and data acquisition (SCADA) network in power systems within quite a short time. This may bring high vulnerability to the cyber-physical power system, which is becoming more dependent on the communication technologies deployed in the SCADA system. The reliability of the power system may be compromised by the worms spreading through the SCADA networks. In this paper, the impact of worm spreading attacks on power system reliability is analyzed. A forced outage rate (FOR) model is proposed considering the impacts of spreading worms on the reliability characteristics. The spreading and detection models of active worms through the network in the SCADA system lead to non-negligible effects on the FOR values. With different FOR values derived by the models of both worm spreading and detection, the loss of load probabilities (LOLP) in two reliability test systems are estimated. The simulation results demonstrated that the reliability of the power system is simultaneously influenced by both the spreading and detection intervals of active worms.

The advanced connection requirements of industrial automation and control systems have sparked a new revolution in the Industrial Internet of Things (IIoT), and the Supervisory Control and Data Acquisition (SCADA) network has evolved into an open and highly interconnected network. In addition, the equipment of industrial electronic devices has experienced complete systemic integration by connecting with the SCADA network, and due to the control and monitoring advantages of SCADA, the interconnectivity and working efficiency among systems have been tremendously improved. However, it is inevitable that the SCADA system cannot be separated from the public network, which indicates that there are concerns over cyber-attacks and cyber-threats, as well as information security breaches, in the SCADA network system. According to this context, this paper proposes a module based on the token authentication service to deter attackers from performing distributed denial-of-service (DDoS) attacks. Moreover, a simulated experiment has been conducted in an energy management system in the actual field, and the experimental results have suggested that the security defense architecture proposed by this paper can effectively improve security and is compatible with real field systems.

The primary purpose of this research was to assess the adequacy and effectiveness of security control of the Supervisory Control and Data Acquisition (SCADA) communication network used by infrastructure companies. Initially, the SCADA networks were physically separated from other networks connected to the internet and hence assumed secure. However, the modern SCADA are now integrated with other network resulting in new security vulnerabilities and attacks similar to those found in traditional IT. Thus, it is important to reassess the security controls of the SCADA because it is operated in an open network environment. In this research, a case of the SCADA security controls in the power sector in Tanzania was assessed, whereby a specific SCADA implementation was studied. The data were gathered using observation, testing, interviews, questionnaire and documentation reviews. The results were analyzed using the Cyber Security Evaluation Tool (CSET) and checked for compliance based on the National Institute of Standards and Technology (NIST) and North America Electric Reliability Corporation (NERC) standards. The findings have shown that there exist security vulnerabilities both in security compliance of the standard and component-based vulnerabilities. Additionally, there is inadequate of audit and accountability, personnel security and system and information integrity. Also, for the component-based security compliance, the finding shows that identification and authentication, security management and audit and accountability. On the basis of the results, the research has indicated the areas that require immediate action in order to protect the critical infrastructure.

Combining ensemble methods and social network metrics for improving accuracy of OCSVM on intrusion detection in SCADA systems

As an emerging and pragmatic network management paradigm, Software-Defined Networking (SDN) provides a promising solution to develop a flexible, vendor-neutral Naval Supervisory Control and Data Acquisition (SCADA) network by using open network protocols. Since SCADA networks are intrinsically vulnerable due to their interconnected and automated nature, Denial of Service (DoS) attack to the SDN-enabled SCADA network is studied in this paper. DoS attack is launched in the SDN network by using Mininet virtualization, Wireshark, and hping3 techniques. The idea is to understand how an attack occurs and uncover the impact of DoS attack to the SDN-enabled SCADA network, thus the corresponding defense strategies can be developed for the DoS attack. Extensive tests on Mininet have demonstrated the DoS attack results for studying the impact of DoS attack. Therefore, the defense strategies can be developed in the future study to enhance the security of the naval SCADA networks.

Attack Traffic Classification (ATC) technique is an essential tool for Industrial Control System (ICS) network security, which can be widely used in active defense, situational awareness, attack source traceback and so on. At present, the state-of-the-art ATC methods are usually based on traffic statistical features and machine learning techniques, including supervised classification methods and unsupervised clustering methods. However, it is difficult for these methods to overcome the problems of lack of attack samples and high real-time requirement in ATC in Supervisory Control and Data Acquisition (SCADA) networks. In order to address the above problems, we propose a self-growing ATC model based on a new density-based heuristic clustering method, which can continuously and automatically detect and distinguish different kinds of unknown attack traffic generated by various attack tools against SCADA networks in real time. An effective representation method of SCADA network traffic is proposed to further improve the performance of ATC. In addition, a large number of experiments are conducted on a compound dataset consisting of the SCADA network dataset, the attack tool dataset and the ICS honeypot dataset, to evaluate the proposed method. The experimental results show that the proposed method outperforms existing state-of-the-art ATC methods in the crucial situation of only normal SCADA network traffic.

The process of ensuring automatic operation for industrial appliances using both supervision and control techniques is a challenging task. Therefore, this article focuses on implementing Supervisory Control and Data Acquisition (SCADA) for controlling all industrial appliances. The design process of implementation case is performed using an analytical framework by examining the primary energy sources at the initial state; thus, a smart network is supported. The designed mathematical model is integrated with a learning technique that allocates resources at proper quantities. Further, the complex manual tuning of individual appliances is avoided in the projected method as the input variables are driven in a direct way at reduced loss state. In addition, the data processing state of individual appliances is carried out using central data controller where all parametric values are stored. In case any errors are observed, then SCADA network fixes the error in an automated way, reducing end-to-end delays in all appliances. To validate the effectiveness of the proposed method, five scenarios are examined and simulated where outcomes prove that SCADA network using learning models provides optimal results on an average of 84 percent as compared to the existing models without learning algorithm.

Despite the increasing awareness of cyber-attacks against Critical Infrastructure (CI), safeguarding the Supervisory Control and Data Acquisition (SCADA) systems remains inadequate. For this purpose, designing an efficient SCADA Intrusion Detection System (IDS) becomes a significant research topic of the researchers to counter cyber-attacks. Most of the existing works present several statistical and machine learning approaches to prevent the SCADA network from the cyber-attacks. Whereas, these approaches failed to concern the most common challenge, “Curse of dimensionality”. This scenario accentuates the necessity of an efficient feature selection algorithm in SCADA IDS where it identifies the relevant features and eliminates the redundant features without any loss of information. Hence, this paper proposes a novel filter-based feature selection approach for the identification of informative features based on Rough Set Theory and Hyper-clique based Binary Whale Optimization Algorithm (RST-HCBWoA). Experiments were carried out by Power system attack dataset and the performance of RST-HCBWoA was evaluated in terms of reduct size, precision, recall, classification accuracy, and time complexity.

Due to the increase in demand and use of Supervisory Control and Data Acquisition (SCADA) systems, it is crucial to provide a risk assessment for ensuring the normal operation of these industrial systems. In this paper, a novel approach based on Analytic Hierarchy Process (AHP) and Rank-Sum Ratio (RSR) is proposed to reduce the subjectivity and uncertainty of risk assessment, quantitatively and comprehensively assess the security risk level in SCADA networks. Furthermore, this method is able to shorten the time of identifying risks after the occurrence of cyber threats. The simulation results illustrate that the proposed approach is effective for relative risk evaluation for SCADA systems.

Firewall configuration is an important activity for any modern day business. It is particularly a critical task for the supervisory control and data acquisition (SCADA) networks that control power stations, water distribution, factory automation, etc. Lack of automation tools to assist with this critical task has resulted in unoptimised, error prone configurations that expose these networks to cyber attacks. Automation can make designing firewall configurations more reliable and their deployment increasingly cost-effective. Best practices have been proposed by the industry for developing high-level security policy (e.g., ANSI/ISA 62443-1-1). But these best practices lack specification in several key aspects needed to allow a firewall to be automatically configured. For instance, the standards are vague on how firewall management policies should be captured at a high-level using its specifications. In this paper, we uncover these missing pieces and propose extensions. We apply our extended best-practice specification to real-world firewall case studies to achieve multiple objectives: 1) to evaluate the usefulness of the refined best-practice in the automated specification of firewalls and 2) to illustrate that even in simple cases, SCADA networks are often insecure due to their misconfigured firewalls.