Security Issues & Application in Korea SCADA

The supervisory control and data acquisition (SCADA) systems monitor and control industrial control systems in many industrial and economic sectors such as water treatment, power plants, railroads, and gas pipelines. The integration of SCADA systems with the internet and corporate enterprise networks for various economical reasons exposes SCADA systems to attacks by hackers who could remotely exploit and gain access to SCADA systems to damage the infrastructure and thereby harming people’s lives. The simplicity of datasets and possible overfitting of models to training data are some of the issues in the previous research. In this paper, we present detecting and classifying malicious command and response packets in a SCADA network by analyzing attribute differences and history of packets using k-means clustering. This study presents a solution to classify SCADA cyber attacks to detect and classify SCADA attacks with high accuracy using a big data framework that comprises of Apache Hadoop and Apache Mahout. Apache Mahout’s random forest classification algorithm is applied on SCADA’s gas pipeline dataset to categorize attacks. When 70% of the data is used for training the classifier, our approach resulted in 5–17% improvement in accuracy for the classification of read response attacks and 2–8% improvement in accuracy for write command attacks with respect to using the original dataset.

SCADA (supervisory control and data acquisition) systems are used to monitor and control the processes of industrial facilities remotely. The use of standard technologies and interconnections between the systems lead to variety of security attacks. SCADA systems are being the part of many critical applications of the society. Any minute deviation in the normal operation of the system results in serious consequences. Hence, securing the industrial control systems is a high priority issue. One can provide security and safety to the system by identifying possible sources of threats and objectives of attackers and continuous monitoring of the operations of the system. In this paper, attack incidents occurred on command and control systems are presented (from the year 1982 to 2017), the general attacker goals on SCADA systems are discussed, SCADA communication protocols and its normal/abnormal behaviors are analyzed using the Wireshark tool.

This paper proposes an intelligent gateway system for SCADA networks to avoid DOS attacks. The proposed approach provides details about an SIG system architecture which establishes the connection between Master SIGs and Perimeter SIGs, the traffic flow, major alerts, and minor alerts. Simulation experiments are an indispensable phase to analyze and assess the security of SCADA (Supervisory Control and Data Acquisition) systems. Although numerous experiments have taken place, limitations are still not been shrunk. The SCADA Intelligence Gateway concept proposed in this paper is experimentally proved and showed its ability to secure the SCADA system from attacks. The intelligence learning mechanism established the ability to identify malicious traffic through bot production and simulation environments.

In view of the insufficient informationization of the stainless steel pipe production line., such as the inability to collect the machine tool's processing data in real time, the inaccurate production information feedback, and the insufficient monitoring of the equipment status, a SCADA (Supervisory Control And Data Acquisition) system is designed to effectively control and monitor the entire stainless steel pipe production line to achieve the information construction of the factory. Siemens S7-1500 series PLC is used as the lower computer of this system, and communicates with the upper computer software through Siemens S7 protocol. The SCADA system is developed in C# language, and its functions include equipment status monitoring, production process monitoring, production statistical analysis and electronic board display. The SCADA system can realize the automation of data collection, data processing and data analysis, which improves the production efficiency and management level of the production line.

The advanced connection requirements of industrial automation and control systems have sparked a new revolution in the Industrial Internet of Things (IIoT), and the Supervisory Control and Data Acquisition (SCADA) network has evolved into an open and highly interconnected network. In addition, the equipment of industrial electronic devices has experienced complete systemic integration by connecting with the SCADA network, and due to the control and monitoring advantages of SCADA, the interconnectivity and working efficiency among systems have been tremendously improved. However, it is inevitable that the SCADA system cannot be separated from the public network, which indicates that there are concerns over cyber-attacks and cyber-threats, as well as information security breaches, in the SCADA network system. According to this context, this paper proposes a module based on the token authentication service to deter attackers from performing distributed denial-of-service (DDoS) attacks. Moreover, a simulated experiment has been conducted in an energy management system in the actual field, and the experimental results have suggested that the security defense architecture proposed by this paper can effectively improve security and is compatible with real field systems.

Supervisory Control and Data Acquisition (SCADA) is used in modern power system for monitoring, controlling, gathering the information, transfer to information back to a central station, carry out necessary analysis and control carry out necessary analysis and control. A SCADA system involves the integrated technologies of computer, communication, electric devices etc. Here the communication media provides the physical medium for transferring, controlling and acquisition of data within SCADA from remote locations. Although wireless communications media become an attractive option as communications networks for SCADA system, compared with wired communications, wireless communications in power system environments presents a number of security and reliability issues. As in SCADA system the communication media plays an important role, to meet objectives of the SCADA systems, different wired and wireless communications media have been applied in modern power system environment. This paper presents a concept about SCADA system using Cognitive Radio based IEEE 802.22 standard for overcoming all existing limitations of SCADA's communication media for future power system where details design, analyses of feasibility and benefits over wired and other wireless systems are also described.

Combining ensemble methods and social network metrics for improving accuracy of OCSVM on intrusion detection in SCADA systems

Active worms are capable of compromising the cyber security of the supervisory control and data acquisition (SCADA) network in power systems within quite a short time. This may bring high vulnerability to the cyber-physical power system, which is becoming more dependent on the communication technologies deployed in the SCADA system. The reliability of the power system may be compromised by the worms spreading through the SCADA networks. In this paper, the impact of worm spreading attacks on power system reliability is analyzed. A forced outage rate (FOR) model is proposed considering the impacts of spreading worms on the reliability characteristics. The spreading and detection models of active worms through the network in the SCADA system lead to non-negligible effects on the FOR values. With different FOR values derived by the models of both worm spreading and detection, the loss of load probabilities (LOLP) in two reliability test systems are estimated. The simulation results demonstrated that the reliability of the power system is simultaneously influenced by both the spreading and detection intervals of active worms.

SCADA (Supervisory Control and Data Acquisition) systems are critical for managing industrial processes, including energy production, manufacturing, and transportation. However, their reliance on protocols such as Modbus, which lack inherent security features, exposes them to sophisticated cyber threats. This paper explores vulnerabilities in the Modbus protocol to design advanced SCADA-specific attack scenarios—SCADA Hijacking and SCADA Blackout. These covert attacks exploit protocol weaknesses to manipulate process parameters or halt operations while evading detection by intrusion detection systems (IDS) and human operators, representing a significant escalation in the sophistication of cyber threats. To counter these threats, we propose a novel machine learning-based defense mechanism that incorporates heterogeneous graph embeddings, combining multimodal network data such as flow-level and packet-level features. The proposed attacks and defense mechanism were rigorously evaluated using precision, recall, F1 score, accuracy and false positive rate as key metrics, demonstrating the stealthiness of the attacks and the robustness of the defense. By exposing critical vulnerabilities and presenting an advanced intrusion detection framework, this research establishes a foundation for strengthening SCADA systems against evolving cyber threats, ensuring the security and reliability of industrial control systems.

Abstract: In the oil and gas sector, supervisory control and data acquisition (SCADA) systems have become a revolutionary force that are transforming operations throughout the whole value chain. This in-depth analysis looks at the development, design, and various uses of SCADA systems in the upstream, middle, and downstream domains. It projects that the global SCADA market for oil and gas will grow to $4.52 billion by 2026. Real-time well monitoring, production optimization, and remote operations are made possible by SCADA systems in upstream operations, which greatly increase output and efficiency. The goal of midstream applications is to increase pipeline efficiency and safety by using predictive maintenance, enhanced leak detection, and flow optimization. By streamlining quality assurance, energy management, and process control, SCADA systems can completely transform refinery operations. SCADA deployments are not without difficulties, though, including data management complications, cybersecurity threats, and legacy system interoperability. In addition to addressing these problems, the study looks at new developments that could improve SCADA capabilities, such as edge computing, digital twins, AI and machine learning integration, and 5G technology. According to the research, SCADA is essential for promoting efficiency, safety, and innovation in the oil and gas industry. Businesses that successfully integrate SCADA technologies while overcoming implementation obstacles will be best positioned to prosper in the complicated and fiercely competitive energy market.

Most of the machinery and equipment of the mine infrastructure is controlled by an industrial automation system. In practice, SCADA (Supervisory Control And Data Acquisition) systems very often acquire many operational parameters that have no further analytical use. The variability of recorded signals very often depends on the machine load, as well as organizational and technical aspects. Therefore, SCADA systems can be a practically free source of information used to determine KPI (e.g. performance, energy and diagnostic) for a single object as well as given mining process. For example, the ability to reliably identify different operational modes of the mining industrial fans based on data from SCADA gives a wide range of potential applications. Accurate information on this subject could be used - apart from basic monitoring and reporting needs (e.g. actual work vs. schedule comparison) – also in more complex problems, like power consumption predictions. Given the variety of industrial fans used in the mining industry and the different operational data collected, this is yet not a trivial task in a general case. The main aim of this article is to provide reliable algorithms solving fans operational mode identification issue, which will be possible to apply in a wide range of potential applications.

Securing and protecting Supervisory Control and Data Acquisition (SCADA) systems have been an active topic of research for the past decades due to the catastrophic and disastrous consequences when these systems are breached or compromised. Therefore, possible cyberattacks and malicious behaviours must be addressed instantly to prevent catastrophic and disastrous consequences on the national critical infrastructures. To this end, intrusion detection systems are considered as an essential security defence mechanism for SCADA networks. It can effectively detect potential cyberattacks and malicious activities and prevent catastrophic consequences. However, zero-day, deception and stealth attacks require a special type of detection methods in which it should be able to identify anomalies and detect possible malicious activities. There are a handful number of studies that have been carried out previously in this regard. However, this area of research is still immature and emerging. Therefore, this research is intended to investigate the merits, limitations and drawbacks of the existing detection methods, investigates the cyberattacks on SCADA systems, identify key features that can be used to discover irregular activities and to put forward the requirements and recommendations for detect cyberattacks and malicious activities in the SCADA networks.

The Supervisory Control and Data Acquisition (SCADA) system has prominent place and play important roles within real time industrial communication included &#34electric stations, oil stations and water purification plants&#34. In this study; the SCADA System main components, architecture and important protocols, which have been used in SCADA message transmission are reviewed. After review, the current research changes the direction (Section: Future Work) to the security of SCADA system and the existing methods or security methods that have been deployed within the SCADA system. This review also gives directions to secure SCADA network communication.

This paper will discuss some of the key features that have been implemented in the user interface component of IPL Energy’s Pipeline Control System (PCS). IPL Energy operates the world’s largest crude oil and liquid pipeline system. In 1968, IPL Energy became one of the first pipeline companies in the world to implement computer based control of its pipeline systems, commonly referred to as SCADA (Supervisory Control And Data Acquisition). Since then, the SCADA system has been continually modified and improved in order to achieve high standards of reliability, safety, and operator functionality. Unlike other SCADA systems, PCS has been developed from the ground up drawing from a wide range of experience and expertise in pipeline design, control, and operation. A brief overview of the past generations of SCADA systems will show how the user interface has evolved into the present system. The focus of the discussion will be on the Line Display, a single screen that can be used to operate a particular pipeline. The Line Display is the main operating screen used to control the pipeline and provides the operator with the current operating conditions, including operating pressures, pump statuses, and important alarms.

Recently, as a demand for connecting Supervisory Control and Data Acquisition (SCADA) systems to open networks increases, the study of SCADA system security becomes an issue. Many researchers have proposed key management schemes for SCADA systems. However, previous studies lack the proper considerations for availability. In this paper, we build up cryptographic security requirements for robust SCADA systems. In addition, we propose a hybrid key management architecture for robust SCADA systems which supports replace protocol for availability and reduces the number of keys to be stored in a master terminal unit.