Attacking and Defending DNP3 ICS/SCADA Systems

Abstract

The highly beneficial contribution of intelligent systems in the industrial domain is undeniable. Automation, supervision, remote control, and fault reduction are some of the various advantages new technologies offer. A protocol demonstrating high utility in industrial settings, and specifically, in smart grids, is Distributed Network Protocol 3 (DNP3), a multi-tier, application layer protocol. Notably, multiple industrial protocols are not as securely designed as expected, considering the highly critical operations occurring in their application domain. In this paper, we explore the internal vulnerabilities-by-design of DNP3, and proceed with the implementation of the attacks discovered, demonstrated through 8 DNP3 attack scenarios. Finally, we design and demonstrate a Deep Neural Network (DNN)-based, multi-model Intrusion Detection Systems (IDS), trained with our experimental network flow cyberattack dataset, and compare our solution with multiple machine learning algorithms used for classification. Our solution demonstrates a high efficiency in the classification of DNP3 cyberattacks, showing an accuracy of 99.0%.

Securing Industrial Control Systems: Components, Cyber Threats, and Machine Learning-Driven Defense Strategies

“…The primary purpose of the slave or outstation is to respond to requests initiated by the master [67]. In this model, the master is empowered to supervise, regulate, and collect data from slaves, thereby facilitating comprehensive control over the production processes [68]. It is divided into three layers, namely:…”

A two-stage cyber attack detection and classification system for smart grids

“…The captured packets are then processed by a feature extraction unit designed to extract network flow features from raw network packets. This unit utilizes two tools named "CICFlowMeter" and "DNP3 parser", as described in [42]. The extracted features include network flow features such as source and destination port numbers, number of packet in the network flow, data rate per second, in addition to DNP3 specific features.…”

“…• DNP3 Disable Unsolicited Messages Attack The DNP3 and TCP/IP network flows generated by each node during the attack execution were produced by using a custom DNP3 Python Parser and the CICFlowMeter, respectively [42]. The resulting dataset, consisting of the above flows and related statistics, was labelled based on the previously listed DNP3 attack types.…”

Relevant Cybersecurity Aspects of IoT Microservices Architectures Deployed over Next-Generation Mobile Networks

“…The Distributed Network Protocol 3 (DNP3), as has already been mentioned, represents a multi-tier application layer protocol, which proves to be particularly useful in critical industrial settings, such as complex electrical grid systems. The authors of the paper [ 55 ] study the internal vulnerabilities which are induced by the design of the DNP3 data transmission protocol. They implement the attack patterns that are determined empirically, and the research process is experimentally documented through eight DNP3 attack scenarios.…”