A first look at machine-to-machine power grid network traffic

Jung, Sang Shin; Formby, David; Day, Carson; Beyah, Raheem

doi:10.1109/smartgridcomm.2014.7007760

Cited by 14 publications

(7 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…When we ran our analysis again over a dataset with a longer duration (6 months vs 2 months) for the same device that was noted in previous research [7], the distribution of ISNs again showed very distinct clusters, as in Figure 2a. However, when we looked closer at the ISN generation shown in Figure 2b, there was no clear pattern or dependence on time, suggesting the use of a very weak pseudo random generator.…”

Section: Resultsmentioning

confidence: 57%

“…After an initial characterization of the dataset [7] suggested that some devices had uneven distributions of TCP ISNs, the issue of TCP ISN generation was studied in more detail. Since the outdated original TCP specifications recommended the use of a clock-based generation algorithm [12], the dataset was first analyzed to see if there was any relationship between time and the ISNs generated.…”

Section: Methodsmentioning

confidence: 99%

See 1 more Smart Citation

An Empirical Study of TCP Vulnerabilities in Critical Power System Devices

Formby

Jung

Copeland

et al. 2014

Proceedings of the 2nd Workshop on Smart Energy Grid Security

Self Cite

View full text Add to dashboard Cite

Implementations of the TCP/IP protocol suite have been patched for decades to reduce the threat of TCP sequence number prediction attacks. TCP, in particular, has been adopted to many devices in the power grid as a transport layer for their applications since it provides reliability. Even though this threat has been well-known for almost three decades, this does not hold true in power grid networks; weak TCP sequence number generation can still be found in many devices used throughout the power grid. Although our analysis only covers one substation, we believe that this is without loss of generality given: 1) the pervasiveness of the flaws throughout the substation devices; and 2) the prominence of the vendors. In this paper, we show how much TCP initial sequence numbers (ISNs) are still predictable and how time is strongly correlated with TCP ISN generation. We collected power grid network traffic from a live substation for six months, and we measured TCP ISN differences and their time differences between TCP connection establishments. In the live substation, we found three unique vendors (135 devices, 68%) from a total of eight vendors (196 devices) running TCP that show strongly predictable patterns of TCP ISN generation.

show abstract

Section: Resultsmentioning

confidence: 57%

Section: Methodsmentioning

confidence: 99%

An Empirical Study of TCP Vulnerabilities in Critical Power System Devices

Formby

Jung

Copeland

et al. 2014

Proceedings of the 2nd Workshop on Smart Energy Grid Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…Much of the limited research that has taken place in the SCADA domain was released in 2012 and found that the traffic of a water distribution facility was unlike that of a typical IT network [2]. In addition to this, research was published in 2014 that provided a high-level look at power substation traffic [21]. Then in 2017, an in-depth study was published that provided a more detailed characterization [15] of behavior across multiple substations and discussed methods to improve TCP for ICS networks.…”

Section: Related Workmentioning

confidence: 99%

If I Knew Then What I Know Now

Irvene

Shekari

Formby

et al. 2019

Proceedings of the Fifth Annual Industrial Control System Security (ICSS) Workshop

Self Cite

View full text Add to dashboard Cite

In the modern world, the reliable and continuous operation of cyberphysical systems (CPSs) have become increasingly crucial factors of our daily life. As a result, the networking protocols of CPSs have been developed to achieve availability without serious consideration for security. Security flaws in these protocols could lead to system misconfigurations or malicious network penetrations which would severely impact the operation of critical infrastructure and control devices on a CPS network. To combat this some researchers have made efforts to design effective intrusion detection and prevention systems (IDSs/IPSs) for providing security in CPS networks. Most of the past and ongoing work in this space explores security from virtual testbeds or simulated systems, many of which make simplifying assumptions. These artificial platforms generally rely on the expectation that CPS networks are behaviorally very similar to traditional information technology (IT) networks and this does not always hold true in practice. In this paper, we investigate and discuss the feasibility and efficacy of previously proposed DNP3 application layer attacks and their mitigation techniques on network traffic captured from four real-world power grid substations. Based on this and a traffic characterization of the captured data we suggest a set of lightweight, but effective mechanisms to help enhance the security of power substations utilizing the DNP3 protocol. This work primarily focuses on DNP3 since it is the most widely used protocol in power substations which form the backbone of the electricity grid. CCS CONCEPTS• Networks → Cyber-physical networks; Network measurement; • Security and privacy → Intrusion detection systems; Network security; • Computer systems organization → Embedded and cyber-physical systems.

show abstract

“…In a separate work [4], Barbosa et al compared the SCADA traffic with SNMP traffic and showed that both traffic types exhibit periodical behavior, as a consequence of the polling mechanism used to retrieve data. In 2014, Jung et al [11] characterized the traffic of a power station network with variations in frame size, TCP connections, TCP ephemeral port number, and TCP initial sequence number. Formby et al [8] characterized the traffic from the same environment and found TCP vulnerabilities in power grid devices.…”

Section: Related Workmentioning

confidence: 99%

Understanding IEC-60870-5-104 Traffic Patterns in SCADA Networks

Lin

Nadjm‐Tehrani

2018

Proceedings of the 4th ACM Workshop on Cyber-Physical System Security

View full text Add to dashboard Cite

The IEC-60870-5-104 (IEC-104) protocol is commonly used in Supervisory Control and Data Acquisition (SCADA) networks to operate critical infrastructures, such as power stations. As the importance of SCADA security is growing, characterization and modeling of SCADA traffic for developing defense mechanisms based on the regularity of the polling mechanism used in SCADA systems has been studied, whereas the characterization of traffic caused by nonpolling mechanisms, such as spontaneous events, has not been well-studied. This paper provides a first look at how the traffic flowing between SCADA components changes over time. It proposes a method built upon Probabilistic Suffix Tree (PST) to discover the underlying timing patterns of spontaneous events. In 11 out of 14 tested data sequences, we see evidence of existence of underlying patterns. Next, the prediction capability of the approach, useful for devising anomaly detection mechanisms, is studied. While some data patterns enable an 80% prediction possibility, more work is needed to tune the method for higher accuracy.

show abstract

A first look at machine-to-machine power grid network traffic

Cited by 14 publications

References 11 publications

An Empirical Study of TCP Vulnerabilities in Critical Power System Devices

An Empirical Study of TCP Vulnerabilities in Critical Power System Devices

If I Knew Then What I Know Now

Understanding IEC-60870-5-104 Traffic Patterns in SCADA Networks

Contact Info

Product

Resources

About