Securing SCADA Energy Management System under DDos Attacks Using Token Verification Approach

The importance of communication security is increased in the power industry, The representative communication network of power industry is the SCADA (Supervisory Control and Data Acquisition) systems. The SCADA system has been used for remote measurement and control in the power industry, Recently, many studies of SCADA network security have been carried out around the world In this paper, we introduce recent security issues in the SCADA network and propose the application of a symmetric encryption method to the Korea SCADA network.

The emergency response system, water and wastewater treatment facilities, oil and gas pipelines, electrical power transmission and distribution, wind farms, defense systems, and large communication networks are all expanding and becoming more vulnerable. That includes DDoS (Distributed Denial of Service) attacks on distributed control systems (DCS) and supervisory control and data acquisition (SCADA) systems. Most cyberattacks on the internet take the form of DOS or DDOS attacks, and their prevalence is rapidly increasing. Forcing people to go without essential services for even a short period of time can cost millions of dollars and put lives at risk. The primary focus of this review paper is an examination and evaluation of some of the more recent recommendations for improving the SCADA system. This review paper focuses on the key research problems that need to be solved to fill the gaps in SCADA system security.

The supervisory control and data acquisition (SCADA) systems monitor and control industrial control systems in many industrial and economic sectors such as water treatment, power plants, railroads, and gas pipelines. The integration of SCADA systems with the internet and corporate enterprise networks for various economical reasons exposes SCADA systems to attacks by hackers who could remotely exploit and gain access to SCADA systems to damage the infrastructure and thereby harming people’s lives. The simplicity of datasets and possible overfitting of models to training data are some of the issues in the previous research. In this paper, we present detecting and classifying malicious command and response packets in a SCADA network by analyzing attribute differences and history of packets using k-means clustering. This study presents a solution to classify SCADA cyber attacks to detect and classify SCADA attacks with high accuracy using a big data framework that comprises of Apache Hadoop and Apache Mahout. Apache Mahout’s random forest classification algorithm is applied on SCADA’s gas pipeline dataset to categorize attacks. When 70% of the data is used for training the classifier, our approach resulted in 5–17% improvement in accuracy for the classification of read response attacks and 2–8% improvement in accuracy for write command attacks with respect to using the original dataset.

Active worms are capable of compromising the cyber security of the supervisory control and data acquisition (SCADA) network in power systems within quite a short time. This may bring high vulnerability to the cyber-physical power system, which is becoming more dependent on the communication technologies deployed in the SCADA system. The reliability of the power system may be compromised by the worms spreading through the SCADA networks. In this paper, the impact of worm spreading attacks on power system reliability is analyzed. A forced outage rate (FOR) model is proposed considering the impacts of spreading worms on the reliability characteristics. The spreading and detection models of active worms through the network in the SCADA system lead to non-negligible effects on the FOR values. With different FOR values derived by the models of both worm spreading and detection, the loss of load probabilities (LOLP) in two reliability test systems are estimated. The simulation results demonstrated that the reliability of the power system is simultaneously influenced by both the spreading and detection intervals of active worms.

A novel approach for accurate detection of the DDoS attacks in SDN-based SCADA systems based on deep recurrent neural networks

This paper proposes an intelligent gateway system for SCADA networks to avoid DOS attacks. The proposed approach provides details about an SIG system architecture which establishes the connection between Master SIGs and Perimeter SIGs, the traffic flow, major alerts, and minor alerts. Simulation experiments are an indispensable phase to analyze and assess the security of SCADA (Supervisory Control and Data Acquisition) systems. Although numerous experiments have taken place, limitations are still not been shrunk. The SCADA Intelligence Gateway concept proposed in this paper is experimentally proved and showed its ability to secure the SCADA system from attacks. The intelligence learning mechanism established the ability to identify malicious traffic through bot production and simulation environments.

SCADA (supervisory control and data acquisition) systems are used to monitor and control the processes of industrial facilities remotely. The use of standard technologies and interconnections between the systems lead to variety of security attacks. SCADA systems are being the part of many critical applications of the society. Any minute deviation in the normal operation of the system results in serious consequences. Hence, securing the industrial control systems is a high priority issue. One can provide security and safety to the system by identifying possible sources of threats and objectives of attackers and continuous monitoring of the operations of the system. In this paper, attack incidents occurred on command and control systems are presented (from the year 1982 to 2017), the general attacker goals on SCADA systems are discussed, SCADA communication protocols and its normal/abnormal behaviors are analyzed using the Wireshark tool.

In view of the insufficient informationization of the stainless steel pipe production line., such as the inability to collect the machine tool's processing data in real time, the inaccurate production information feedback, and the insufficient monitoring of the equipment status, a SCADA (Supervisory Control And Data Acquisition) system is designed to effectively control and monitor the entire stainless steel pipe production line to achieve the information construction of the factory. Siemens S7-1500 series PLC is used as the lower computer of this system, and communicates with the upper computer software through Siemens S7 protocol. The SCADA system is developed in C# language, and its functions include equipment status monitoring, production process monitoring, production statistical analysis and electronic board display. The SCADA system can realize the automation of data collection, data processing and data analysis, which improves the production efficiency and management level of the production line.

Supervisory Control and Data Acquisition (SCADA) is used in modern power system for monitoring, controlling, gathering the information, transfer to information back to a central station, carry out necessary analysis and control carry out necessary analysis and control. A SCADA system involves the integrated technologies of computer, communication, electric devices etc. Here the communication media provides the physical medium for transferring, controlling and acquisition of data within SCADA from remote locations. Although wireless communications media become an attractive option as communications networks for SCADA system, compared with wired communications, wireless communications in power system environments presents a number of security and reliability issues. As in SCADA system the communication media plays an important role, to meet objectives of the SCADA systems, different wired and wireless communications media have been applied in modern power system environment. This paper presents a concept about SCADA system using Cognitive Radio based IEEE 802.22 standard for overcoming all existing limitations of SCADA's communication media for future power system where details design, analyses of feasibility and benefits over wired and other wireless systems are also described.

Most of the machinery and equipment of the mine infrastructure is controlled by an industrial automation system. In practice, SCADA (Supervisory Control And Data Acquisition) systems very often acquire many operational parameters that have no further analytical use. The variability of recorded signals very often depends on the machine load, as well as organizational and technical aspects. Therefore, SCADA systems can be a practically free source of information used to determine KPI (e.g. performance, energy and diagnostic) for a single object as well as given mining process. For example, the ability to reliably identify different operational modes of the mining industrial fans based on data from SCADA gives a wide range of potential applications. Accurate information on this subject could be used - apart from basic monitoring and reporting needs (e.g. actual work vs. schedule comparison) – also in more complex problems, like power consumption predictions. Given the variety of industrial fans used in the mining industry and the different operational data collected, this is yet not a trivial task in a general case. The main aim of this article is to provide reliable algorithms solving fans operational mode identification issue, which will be possible to apply in a wide range of potential applications.

Combining ensemble methods and social network metrics for improving accuracy of OCSVM on intrusion detection in SCADA systems

A novel approach of interdependency modeling of Smart Grid and Supervisory Control and Data Acquisition (SCADA) networks is introduced. Methodological approach for vulnerability reduction considering both structural and functional vulnerability is introduced in this paper. The analysis of cyber-attacks on Smart Grid and SCADA network is discussed. Paper discusses importance and need of clean, sustainable and green energy for the future. Paper also analyzes interdependent Smart Grid and SCADA network under severe emergency situations. The contribution of this paper provides novel network with integrated infrastructures for active and survivable network operation. Thus novel Smart Grid and SCADA interdependency network will act as future's clean, sustainable and Green energy model.

Abstract: In the oil and gas sector, supervisory control and data acquisition (SCADA) systems have become a revolutionary force that are transforming operations throughout the whole value chain. This in-depth analysis looks at the development, design, and various uses of SCADA systems in the upstream, middle, and downstream domains. It projects that the global SCADA market for oil and gas will grow to $4.52 billion by 2026. Real-time well monitoring, production optimization, and remote operations are made possible by SCADA systems in upstream operations, which greatly increase output and efficiency. The goal of midstream applications is to increase pipeline efficiency and safety by using predictive maintenance, enhanced leak detection, and flow optimization. By streamlining quality assurance, energy management, and process control, SCADA systems can completely transform refinery operations. SCADA deployments are not without difficulties, though, including data management complications, cybersecurity threats, and legacy system interoperability. In addition to addressing these problems, the study looks at new developments that could improve SCADA capabilities, such as edge computing, digital twins, AI and machine learning integration, and 5G technology. According to the research, SCADA is essential for promoting efficiency, safety, and innovation in the oil and gas industry. Businesses that successfully integrate SCADA technologies while overcoming implementation obstacles will be best positioned to prosper in the complicated and fiercely competitive energy market.

Securing and protecting Supervisory Control and Data Acquisition (SCADA) systems have been an active topic of research for the past decades due to the catastrophic and disastrous consequences when these systems are breached or compromised. Therefore, possible cyberattacks and malicious behaviours must be addressed instantly to prevent catastrophic and disastrous consequences on the national critical infrastructures. To this end, intrusion detection systems are considered as an essential security defence mechanism for SCADA networks. It can effectively detect potential cyberattacks and malicious activities and prevent catastrophic consequences. However, zero-day, deception and stealth attacks require a special type of detection methods in which it should be able to identify anomalies and detect possible malicious activities. There are a handful number of studies that have been carried out previously in this regard. However, this area of research is still immature and emerging. Therefore, this research is intended to investigate the merits, limitations and drawbacks of the existing detection methods, investigates the cyberattacks on SCADA systems, identify key features that can be used to discover irregular activities and to put forward the requirements and recommendations for detect cyberattacks and malicious activities in the SCADA networks.

Attack Traffic Classification (ATC) technique is an essential tool for Industrial Control System (ICS) network security, which can be widely used in active defense, situational awareness, attack source traceback and so on. At present, the state-of-the-art ATC methods are usually based on traffic statistical features and machine learning techniques, including supervised classification methods and unsupervised clustering methods. However, it is difficult for these methods to overcome the problems of lack of attack samples and high real-time requirement in ATC in Supervisory Control and Data Acquisition (SCADA) networks. In order to address the above problems, we propose a self-growing ATC model based on a new density-based heuristic clustering method, which can continuously and automatically detect and distinguish different kinds of unknown attack traffic generated by various attack tools against SCADA networks in real time. An effective representation method of SCADA network traffic is proposed to further improve the performance of ATC. In addition, a large number of experiments are conducted on a compound dataset consisting of the SCADA network dataset, the attack tool dataset and the ICS honeypot dataset, to evaluate the proposed method. The experimental results show that the proposed method outperforms existing state-of-the-art ATC methods in the crucial situation of only normal SCADA network traffic.