Modeling And Detecting Anomalies In Scada Systems

Abstract

The detection of attacks and intrusions based on anomalies is hampered by the limits of specificity underlying the detection techniques. However, in the case of many critical infrastructure systems, domain-specific knowledge and models can impose constraints that potentially reduce error rates. At the same time, attackers can use their knowledge of system behavior to mask their manipulations, causing adverse effects to observed only after a significant period of time. This paper describes elementary statistical techniques that can be applied to detect anomalies in critical infrastructure networks. A SCADA system employed in liquefied natural gas (LNG) production is used as a case study.

Detecting Sensor Signal Manipulations in Non-Linear Chemical Processes

“…The predictable nature of SCADA traffic can be leveraged to detect system anomalies [5,21,24]. However, a knowledgeable attacker can seize the advantage by manipulating computational states or utilizing signal noise to obfuscate attacks that would otherwise be recognized [4,20,21].…”

“…We argue that this adversary capability highlights a requirement for additional sensors [2,6,20] to provide different points of view in order to detect anomalies [21]. This requirement is underscored by the introduction of sophisticated control processes that rely on multivariate controls and, hence, require more complex forms of supervision [19].…”

“…In previous work [20], we showed that simple statistical anomaly detection can be bypassed by a knowledgeable attacker, underscoring the need for a multisensor approach to detection. We, therefore, proposed a novel approach that analyzes process correlations using additional sensors [15].…”

Risk Data Analysis Based Anomaly Detection of Ship Information System

“…Here, we mainly focus on the anomaly detection topic in the cyber-physical security of SCADA. Actually, several effective anomaly detection methods have already been proposed in the anomaly detection area such as system modeling [15][16][17][18][19][20] and data-based analysis [20][21][22][23][24][25], which should always accept a compromise in the modeling uncertainty and data complexity. Besides model-based and coupled data-based intrusion detection, some intrinsic properties of SCADA are considered in detection.…”

Monitoring approach of Supervisory Control and Data Acquisition downloadable data files for “mission — critical” situations detection

“…A second approach is to model the normal data flows and control operations within the S.C.A.D.A system to detect anomalies caused by attempts to change or damage the system. This has the advantage that it can detect unknown attacks and the action of malicious insiders, but unless it is handled carefully it can generate a lot of false alarms [13].…”