State-based network intrusion detection systems for SCADA protocols: a proof of concept

Authors:
Andrea Carcano;Igor Nai Fovino;Marcelo Masera;Alberto Trombetta
Affiliations:
University of Insubria, Varese, Italy;Joint Research Centre, Institute for the Protection and Security of the Citizen, Ispra, Italy;Joint Research Centre, Institute for the Protection and Security of the Citizen, Ispra, Italy;University of Insubria, Varese, Italy
Venue:
CRITIS'09 Proceedings of the 4th international conference on Critical information infrastructures security
Year:
2009

Citing 4
Cited 4

An Intrusion-Detection Model

IEEE Transactions on Software Engineering - Special issue on computer security and privacy
Constructing attack scenarios through correlation of intrusion alerts

Proceedings of the 9th ACM conference on Computer and communications security
Alert Correlation in a Cooperative Intrusion Detection Framework

SP '02 Proceedings of the 2002 IEEE Symposium on Security and Privacy
Snort - Lightweight Intrusion Detection for Networks

LISA '99 Proceedings of the 13th USENIX conference on System administration

Semantic security analysis of SCADA networks to detect malicious control commands in power grids

Proceedings of the first ACM workshop on Smart energy grid security
Towards learning normality for anomaly detection in industrial control networks

AIMS'13 Proceedings of the 7th IFIP WG 6.6 international conference on Autonomous Infrastructure, Management, and Security: emerging management mechanisms for the future internet - Volume 7943
Towards the protection of industrial control systems: conclusions of a vulnerability analysis of profinet IO

DIMVA'13 Proceedings of the 10th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
A survey of intrusion detection techniques for cyber-physical systems

ACM Computing Surveys (CSUR)

Quantified Score

Hi-index	0.00

Visualization

Abstract

We present a novel Intrusion Detection System able to detect complex attacks to SCADA systems. By complex attack, we mean a set of commands (carried in Modbus packets) that, while licit when considered in isolation on a single-packet basis, interfere with the correct behavior of the system. The proposed IDS detects such attacks thanks to an internal representation of the controlled SCADA system and a corresponding rule language, powerful enough to express the system's critical states. Furthermore, we detail the implementation and provide experimental comparative results.