Scaphy: Detecting Modern ICS Attacks by Correlating Behaviors in SCADA and PHYsical

Ike, Moses; Phan, Kandy; Keaton, Sadoski,; Valme, Romuald; Lee, Wenke

doi:10.1109/sp46215.2023.10179411

Cited by 4 publications

(6 citation statements)

References 55 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These 11 packets represent a complete process, in which packets (1)-( 9) are the initialization phase and packets (10) and (11) are the data exchange phase. These constant values are necessary for attackers to launch semantic attacks.…”

Section: Building the Fsm Modelmentioning

confidence: 99%

“…Additionally, there is no transfer to the initialization phase when the data exchange phase is in progress. For example, packet (10) activates the I/0 point position of the slave station and collects data from that point. The slave receives the packet (10) and communicates to the master that the current I/O position is in the active state packet (11).…”

Section: Building the Fsm Modelmentioning

confidence: 99%

“…For example, packet (10) activates the I/0 point position of the slave station and collects data from that point. The slave receives the packet (10) and communicates to the master that the current I/O position is in the active state packet (11). Next, the master and slave communicate in a cyclic manner, i.e., packets (10) and packets (11) appear periodically in the industrial bus network.…”

Section: Building the Fsm Modelmentioning

confidence: 99%

“…To detect ICS attacks, statistical analysis [6,8,9] based on a "five-tuple" (i.e., <packet length, port, response time, destination IP, and source IP>) of ICS protocols is effective for noisy attacks (e.g., probing scans and erroneous packets), but fails to detect advanced attackers using advanced semantic attacks, i.e., legitimate protocols and ICS parameters [10]. As a result, semantic attacks can bypass this detection method and compromise the security of the physical world of the ICS.…”

Section: Introductionmentioning

confidence: 99%

“…As a result, semantic attacks can bypass this detection method and compromise the security of the physical world of the ICS. In general, existing ICS detection tools are circumvented by semantic attacks and are prone to false alarms due to the isolated analysis of traffic and sensor data, as they cannot relate their analysis to the attack execution context of the ICS [10]. Detecting bus network attacks on ICSs is difficult because of the complex bus network structure, the large attack surface, and the fact that attackers use packets that differ from those conforming to the protocol specification.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

DpGuard: A Lightweight Attack Detection Method for an Industrial Bus Network

Li¹,

Wei²,

Ma³

et al. 2023

Electronics

View full text Add to dashboard Cite

In industrial control systems (ICSs), the PROFIBUS-DP (decentralized peripherals) protocol is widely used for communication between devices. Because PROFIBUS-DP is an unencrypted and insecure bus protocol, attackers can connect to the PROFIBUS-DP system and arbitrarily manipulate I/O process values, which may interrupt the normal operation of industrial equipment, or have more serious consequences. However, due to the complex structures of bus networks and the large number of attack areas, the existing scheme does not monitor all the messages in the industrial head office network and cannot effectively detect semantic attacks. To solve this problem, we propose a novel attack detection system DpGuard. DpGuard automatically builds a finite-state machine model of normal ICS behavior through a large number of historical ICS traffic data. The model includes state events, state transitions, state transition probability, and other normal behavior information. In addition, DpGuard records the execution status of the context data package, uses the real-time captured data package as the input of the model, and judges whether the state event and state transition probability conform to the constraints of the finite-state machine model, so as to identify the legitimate normal behavior of the ICS. Our proposal was evaluated using two Siemens PLCs (programmable logic controllers) deployed on the PROFIBUS-DP system. The experimental results demonstrated that the scheme could accurately detect fault injection and semantic attacks. Compared with other detection models, our scheme presented an improved detection performance, with a detection accuracy of 99.80%.

show abstract

Section: Building the Fsm Modelmentioning

confidence: 99%