Supervisory Control and Data Acquisition (SCADA) systems and Industrial Control Systems (ICSs) have controlled the regulation and management of Critical National Infrastructure environments for decades. With the demand for remote facilities to be controlled and monitored, industries have continued to adopt Internet technology into their ICS and SCADA systems so that their enterprise can span across international borders in order to meet the demand of modern living. Although this is a necessity, it could prove to be potentially dangerous. The devices that make up ICS and SCADA systems have bespoke purposes and are often inherently vulnerable and difficult to merge with newer technologies. The focus of this article is to explore, test, and critically analyse the use of network scanning tools against bespoke SCADA equipment in order to identify the issues with conducting asset discovery or service detection on SCADA systems with the same tools used on conventional IP networks. The observations and results of the experiments conducted are helpful in evaluating their feasibility and whether they have a negative impact on how they operate. This in turn helps deduce whether network scanners open a new set of vulnerabilities unique to SCADA systems.

No abstract

No abstract

In this study, we present a detailed analysis of deep learning techniques for intrusion detection. Specifically, we analyze seven deep learning models, including, deep neural networks, recurrent neural networks, convolutional neural networks, restricted Boltzmann machine, deep belief networks, deep Boltzmann machines, and deep autoencoders. For each deep learning model, we study the performance of the model in binary classification and multiclass classification. We use the CSE-CIC-IDS 2018 dataset and TensorFlow system as the benchmark dataset and software library in intrusion detection experiments. In addition, we use the most important performance indicators, namely, accuracy, detection rate, and false alarm rate for evaluating the efficiency of several methods.

In order to deter or prosecute for cyber attacks on industrial control systems it is necessary to assign attribution to the attacker and define the type of attack so that international law enforcement agencies or national governments can decide on appropriate recourse. In this paper we identify the current state of the art of attribution in industrial control systems. We highlight the critical differences between attribution in enterprise networks and attribution in industrial networks. In doing so we provide a roadmap for future research.