Implementing attacks for modbus/TCP protocol in a real-time cyber physical system test bed

Abstract

To understand security vulnerabilities of communication protocols used in power systems, a real-time framework can be developed to conduct vulnerability studies. The framework should implement protection mechanisms against vulnerabilities and study their effectiveness. In this paper, a realtime cyber-physical framework or test bed is presented. It integrates a real-time power system simulator and a communication system simulator to study the cyber and physical system vulnerabilities in smart power grids. The power system simulation is implemented using the Real-Time Digital Simulator (RTDS®) power grid simulator, with LabVIEW and PXI modules that simulate the supervisory control and data acquisition (SCADA) system and intelligent electronic devices (IEDs). The communication system simulation is implemented using Opnet's System-in-the-Loop (SITL) simulator and open source Linux tools and servers. Results of two cyber-attacks on the Modbus/TCPprotocol are discussed and improvements to the test bed for protocol attack detection and mitigation are proposed.

Performance Evaluation of Modbus TCP in Normal Operation and Under A Distributed Denial of Service Attack

“…Figure 15 depicts the total number of failed requests per second during the same experiments. We varied the response timeout (20,25,30,35,40,45,50,55, and 60 ms) and the number of child processes (1, 2, 3, 5, 7, and 9 child processes). For these experiments, we set the delay between requests in 0 ms to get the maximum possible numbers of requests successfully processed per second.…”

“…The communication between devices was done through WiFi, with the same wireless router of the previous experiment (NETGEAR N300 model WNR2020v2). Figure 16 shows the obtained results, with three attackers, a delay between requests of 0 s for both the legal querier and attackers, a flooding period of 20 s for the attackers, a response timeout of 500 ms for the attackers, and different values of the response timeout for the legal querier (20,40, and 60 ms, as the gray, orange, and blue curves, respectively). The attackers were activated at 4, 8, and 12 s. Since the flooding period of the attackers was 20 s, they ended their attack at times 24, 28, and 32 s, respectively.…”

“…In the area of security for Modbus TCP, the authors of [19] used Snort [36], a well-known network intrusion detection and prevention system, to detect a flooding attack. Chen, Pattanaik, Goulart, Butler-Purry, and Kundur [20] studied a Man-in-the-Middle (MITM) attack and a DoS attack over the Modbus TCP protocol. To do so, they developed a testbed with a real-time power system simulator and a communication system simulator.…”

Untitled

“…When the three attackers were active (from 12 to 24 s), Figure 16 shows that the DDoS attack had a devastating effect over the legal traffic, especially for a response timeout of 20 ms (gray curve), since the legal querier was almost not able to poll the EMS8266. Figure 17 shows the obtained results, with four attackers, a delay between requests of 0 s for both the legal querier and attackers, a flooding period of 24 s for the attackers, a response timeout of 500 ms for the attackers, and different values of the response timeout for the legal querier (20,40, and 60 ms, as the gray, orange, and blue curves, respectively). The attackers were activated at 4, 8, 12, and 16 s.…”

Adversarial Machine Learning in Smart Energy Systems

“…Even when the asset communicates via an on-premise gateway, provided by the aggregator and which is tightly locked down, communications between the asset and gateway are typically performed over simple, unencrypted protocols. It is trivial to inject false Modbus TCP messages [1], or use an off-the-shelf emulator to simulate a malicious asset entirely, complete with a full audit trail of plausible data. This error is unlikely to be caught unless significant discrepancies exist between the site's metered electricity usage and the logs submitted as evidence of FR participation.…”