Network Anomaly Detection for M-Connected SCADA Networks

Abstract

In the current national critical infrastructures, SCADA systems and networks are playing very important roles. Unfortunately, most of closed-network SCADA systems have been considered as very secure against cyber-attacks. Because they use their own operating systems and communication/ network protocols, and their private networks are physically isolated from the public networks and the Internet. However, in case the closed SCADA system has m-connected status due to its maintenance, updates, and patches, it is no longer perfectly secure against cyber-attacks. This paper analyzes vulnerabilities of m-connected SCADA networks and proposes a novel security model for detecting network anomalies. The proposed model is based on an intrusion detection system using the network-based pattern reference method, which has two kinds of rule sets -one is the base rule set, and the other is dynamically produced rule set. The basic rule set can be set with pre-known intrusion patterns, and a dynamically produced new rule set can be set by detecting network anomalies under specific threshold values. Such new rule set would be adapted to the pattern reference model in its next execution time. Therefore, the proposed security model can identify abnormal command execution more effectively and efficiently.

A New Cellular Architecture for Information Retrieval from Sensor Networks through Embedded Service and Security Protocols

“…A number of researches have been made to secure SCADA systems and their communications, and most of them are based on end-to-end security mechanisms, dependent on open security protocols such as, SSL/TLS, IPSec, and SSH, through the installation of security software such as firewalls, DMZs, intrusion detection and prevention mechanism and others [ 11 , 31 , 39 , 40 , 41 , 42 , 43 , 44 , 45 , 46 , 47 , 48 , 49 ]. A limited amount of literature has also described the trends in SCADA cellular communication security, but most of mentioned as proposed works, or developments in the initial stages [ 13 , 39 , 50 ].…”

Secure Model against APT in m-Connected SCADA Network

“…In addition, security vulnerabilities appear after general-purpose hardware and software begin to be used. An m-connected SCADA network that operates within both open platforms and closed platforms shows serious weak points [3].…”

“…Recently, APT attacks, using very intelligent, viable, and malicious codes such as Duqu, Flame, and Gauss, which are variants of Stuxnet, occurred on SCADA networks. In addition, the appearance of the malicious code Flamer (W32.Flamer), which targets national infrastructures and can leak information after an attack, has increased concerns regarding information security [1][2][3]. Similarly, new attack methods, such as the polymorphism attack that occurs, namely, through the server from where other attackers automatically generate mutagenic malicious code that was obtained from the attacker's website, have appeared and constantly take place, along with high-skilled targeted attacks, including APT attacks.…”

“…m-Connected SCADA Network. As we explained above, even a closed SCADA network can be momentary online status which is defined as "m-connected" status, and such temporary pseudoconnections are made by portable mediums such as external flash memory, floppy disks, and CD-ROMs which are used to perform maintenance tasks including patching, upgrades, and migration [3]. So "m-connected SCADA network" is a closed, isolated, and private SCADA network which has, however, similar levels of vulnerabilities to open online SCADA networks in a long-term observation.…”

“…The SCADA system which was then allowed to operate in a closed private network disconnected from the Internet for not being a victim to cyber danger now strongly requires various types of external connections along with remote maintenance and usage of mobile storage mediums such as USB flash memory. Such an environmental change means that the securities of the SCADA system, which are rooted in the characteristics of closed networks, can no longer be maintained [3]. Our proposed m-connected SCADA network is defined in this paper in order to analyze the weak points that can take place while closed SCADA jobs are performed and to present a security model against advanced persistent threat (APT) attacks.…”