Passive Fingerprinting of SCADA in Critical Infrastructure Network without Deep Packet Inspection

Jeon, Seongmin; Yun, Jeong-Han; Choi, Seungoh; Kim, Woonyon

doi:10.48550/arxiv.1608.07679

Cited by 1 publication

(2 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Literature [6] proposes that using the TCP timestamp option in the TCP header to detect the clock deviation of a single device for single device fingerprinting. In [24], researchers use wavelet analysis to identify wireless access points based on frame arrival interval time increments, but this type of technology is not suitable for an industrial control device, as it relies on access points to route data to fingerprint readers. Radhakrishnan et al [25] introduce another time-based device fingerprinting technique called "GTID" to identify wireless devices and their types using the distribution of packet arrival intervals.…”

Section: Related Workmentioning

confidence: 99%

“…Some device fingerprinting studies [11][12][13]28] focus on the characteristics of data packets, and the fingerprinting technology in this paper is similar to these studies. Jeon [24] provides a passive fingerprinting method for industrial control devices based on five characteristics of flow data, namely periodicity, communication persistence, device complexity gap, network service popularity, and segment size. Based on these characteristics, they calculate a ranking score for each device to distinguish between field devices and master servers.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Development of Fingerprint Identification Based on Device Flow in Industrial Control System

et al. 2023

View full text Add to dashboard Cite

With the rapid development of industrial automation technology, a large number of industrial control devices have emerged in cyberspace, but the security of open cyberspace is difficult to guarantee. Attacks on industrial control devices can directly endanger the environment and even life safety. Therefore, how to monitor the industrial control system in real time has become the primary problem, and device identification is the basic guarantee of safety monitoring. There are limitations in building device identification model based on IP address or machine learning. The paper aim at the development of a device traffic fingerprint model and identify the device based on the periodicity of device traffic. The model generates device fingerprints based on pattern sequences abstracted from the traffic and suffix array algorithm. In the process of recognition, the exact pattern matching algorithm is used for preliminary judgment. If the exact pattern matching fails to hit, the final judgment is made by combination fuzzy pattern matching. This paper also proposes a diagonal jump algorithm to optimize the updating of the distance matrix, which saves on the computational cost of fuzzy pattern matching. Simulation results show that compared with SVM, random forest, and LSTM model, the device traffic fingerprint model has good performance advantages in accuracy, recall and precision.

show abstract

Section: Related Workmentioning

confidence: 99%