Encrypted DNP3 Traffic Classification Using Supervised Machine Learning Algorithms

Abstract

The Distributed Network Protocol (DNP3) is predominately used by the electric utility industry and, consequently, in smart grids. The Peekaboo attack was created to compromise DNP3 traffic, in which a man-in-the-middle on a communication link can capture and drop selected encrypted DNP3 messages by using support vector machine learning algorithms. The communication networks of smart grids are a important part of their infrastructure, so it is of critical importance to keep this communication secure and reliable. The main contribution of this paper is to compare the use of machine learning techniques to classify messages of the same protocol exchanged in encrypted tunnels. The study considers four simulated cases of encrypted DNP3 traffic scenarios and four different supervised machine learning algorithms: Decision tree, nearest-neighbor, support vector machine, and naive Bayes. The results obtained show that it is possible to extend a Peekaboo attack over multiple substations, using a decision tree learning algorithm, and to gather significant information from a system that communicates using encrypted DNP3 traffic.

The trends of supervisory control and data acquisition security challenges in heterogeneous networks

“…Researchers in [18] find out that by using supervised machine learning algorithm support vector machine (SVM), the encrypted data packet in SCADA network running DNP3 protocol can be classified. Thus, a man-in-the-middle (MiTM) on communication link can capture as well as remove the encrypted DNP3 packet data that already selected by the SVM, this is due to the opening of the SCADA connection to the Heterogeneous networks.…”

“…Thus, a man-in-the-middle (MiTM) on communication link can capture as well as remove the encrypted DNP3 packet data that already selected by the SVM, this is due to the opening of the SCADA connection to the Heterogeneous networks. Figure 1 illustrates the effect of SCADA network interconnection to external heterogeneous network as described by the above previous works [18].…”

“…The researchers use the attack scenario with MiTM attacker that targets the IEC 104 protocol by changing the cause of transmission (COT) value to an invalid value. The work focuses on the MiTM type of attack for changing the (COT) value, however many other attack types are carried out by other research works, such as in [9] which uses DoS Attack on IEC 104 protocol, and in [18] which uses injection and dropping attack on DNP3 protocol, researchers in [21] conduct experiments on reconnaissance, injection, masquerading, replay, and flooding attack on DNP3 protocol. In this case, the dataset used by [11] is not suitable for the use in other attack scenarios.…”

“…The first vulnerability is at point A, where this point located in the area that having physical devices such as RTU device, HMI, and historian server as shown in Figure 3. MiTM attacker resides in the communication link can perform data dropping and change [18]. Besides, attack in the form of physical device attack most probably may happen in this point, since the attacker has already in the network that directly connects to the physical devices [7].…”

Toward an Applied Cyber Security Solution in IoT-Based Smart Grids: An Intrusion Detection System Approach

“…With regard to machine learning methods, de Toledo et al [19] developed a method that encrypts the traffic using the DNP3 protocol. This study used supervised algorithms to classify messages from the same protocol using datasets from the medium voltage of substations using simulation methods.…”