Securing Big Data from Eavesdropping Attacks in SCADA/ICS Network Data Streams through Impulsive Statistical Fingerprinting

Abstract

While data from Supervisory Control And Data Acquisition (SCADA) systems is sent upstream, it is both the length of pulses as well as their frequency present an excellent opportunity to incorporate statistical fingerprinting. This is so, because datagrams in SCADA traffic follow a poison distribution. Although wrapping the SCADA traffic in a protective IPsec stream is an obvious choice, thin clients and unreliable communication channels make is less than ideal to use cryptographic solutions for security SCADA traffic. In this paper, we propose a smart alternative of data obfuscation in the form of Impulsive Statistical Fingerprinting (ISF). We provide important insights into our research in healthcare SCADA data security and the use of ISF. We substantiate the conversion of sensor data through the ISF into HL7 format and define policies of a seamless switch to a non HL7-based non-secure HIS to a secure HIS.The ISO/IEEE 11073 and HL7 have successfully played a key role in enabling the medical devices to exchange data amongst themselves. Due to privacy and security issues, this data needs to be protected. Since medical devices are not typically computationally very proficient and the standards advocate lightweight communications, a cryptographic data security scheme is not an ideal solution to go ahead with [4]. In order to address this problem, we propose to use the statistical fingerprinting as data obfuscation method.The Impulsive Statistical Fingerprinting (ISF) was used by Crotti et al. to classify the network traffic for anomaly detection [5]. When network traffic shows an atypical pattern and skewness from the "normal" traffic pattern, this is raised as an anomaly to the system [6]. We use the ISF to prevent leaf sensors from broadcasting the actual readings. Since the ISO/IEEE 11073 allows the flexibility to transmit metadata in the HL7 packet, we calculate the statistical model proposed in this paper to calculate the obfuscated values from sensors before translating the communication in the HL7 format.The statistical model proposed in this paper assumes that the devices are already connected and configured in a network. An initial handshaking between PHDs and IP network provide the baseline values for mean calculation that will help in recalculating back to original values of the sensor data. From the results reported in [7] we learn that the PHDs send periodic metric report containing time stamp, and status value which reports device errors and alarms. The time stamps received from the devices helps keep both the TCP session [8] and time series data consistent. Using the statistical method proposed in [9], which assumes that the time series data is stationary, we consult to the history of the PHD values. We use the algorithm proposed in [9] and apply autoregressive integrated moving average models to find the best fit of the time series model to past values of the time series. An adversary, who is using a Man-in-The-Middle (MiTM) attack, needs to know considerable amount of time series data to predict the...

Survey on Internet of Things (IoT) for Different Industry Environments

“…The overall design and development of the IoT network usually track the rapid approach and inflate the current IoT practices and identification like RFID. Intercontinental research collaboration and efforts are desired to discourse the above IoT environment associated issues and challenges [50] [51] [62]. Moreover, to start the research exploration to address the discussed issues and challenges; followings, we have classified a few more research trends:…”

A Hierarchical Federated Learning-Based Intrusion Detection System for 5G Smart Grids

“…However, the uncertain environment, wide distribution and bidirectional communication networks will make the AMI system susceptible to attacks [8]. Attacks such as man-in-the-middle (MITM) [9], jamming [10], false data injection (FDI) [11], eavesdropping [12], denial of service (DoS) [13], and message replay [14] can damage the confidentiality and availability of the AMI system. For example, hacking into smart meters compromises users' privacy, and intrusion into cloud servers causes system destruction and energy price manipulation.…”

Corrections to “Risk Analysis of Cloud Sourcing in Healthcare and Public Health Industry”

“…In above article [1], reference [11] is incorrect as the conference article had not been published in full until 2019. The correct reference is cited here as [2]. Therefore, the sentences in the article [1] with reference [11] should be cited [2] in this article as ''When the data are stored in a centralized location and are transmitted by applying symmetric data encryption techniques, the deployment and maintenance costs will go beyond cost tolerance thresholds [2],'' ''Since cloud computing signifies a comparatively novel computing representation at every level, like applications, hosts, network, and data, that in turn raises the issue of the application safety to shift toward cloud computing [2] and [3],'' and ''However, this definition is not accurate in the sense that, if the normal operation is susceptible to eavesdropping, in this case, the normal operation of the organization must be restricted [2].…”