Understanding IEC-60870-5-104 Traffic Patterns in SCADA Networks

Abstract

The IEC-60870-5-104 (IEC-104) protocol is commonly used in Supervisory Control and Data Acquisition (SCADA) networks to operate critical infrastructures, such as power stations. As the importance of SCADA security is growing, characterization and modeling of SCADA traffic for developing defense mechanisms based on the regularity of the polling mechanism used in SCADA systems has been studied, whereas the characterization of traffic caused by nonpolling mechanisms, such as spontaneous events, has not been well-studied. This paper provides a first look at how the traffic flowing between SCADA components changes over time. It proposes a method built upon Probabilistic Suffix Tree (PST) to discover the underlying timing patterns of spontaneous events. In 11 out of 14 tested data sequences, we see evidence of existence of underlying patterns. Next, the prediction capability of the approach, useful for devising anomaly detection mechanisms, is studied. While some data patterns enable an 80% prediction possibility, more work is needed to tune the method for higher accuracy.

The trends of supervisory control and data acquisition security challenges in heterogeneous networks

“…Therefore, the procedure to deploy an IDS on the SCADA network is not so different from the deployment on general TCP/IP networks. Nevertheless, before building and deploying an IDS on SCADA network, we have to know normal patterns of TCP data packets that contain SCADA protocol packets before understanding the data packet that contains an attack packet as proposed by Lin et al [8] in understanding IEC 104 traffic patterns and Hodo et al [9] for anomalies in the SCADA system on the IEC 104 protocol. Subsection 3.1 discusses details of security holes in the five crucial points in Figure 2 that are used as a backdoor to exploit the SCADA system, subsection 3.2 discusses how the IDS alarm sensors are set up on those five points, so the IDS can work efficiently and accurately for detecting anomalies in the system SCADA networks and subsection 3.3 proposes a model for a future study to generate reliable IDS in the SCADA system.…”

“…Research work that aims to study the traffic data in the SCADA system have been carried out by [8]. The researchers investigate the normal traffic of the international electrotechnical commission (IEC) 104 protocol in the SCADA system.…”

IEC 60870-5-104 Network Characterization of a Large-Scale Operational Power Grid

“…As such, we further analyzed this particular type of Per/Cyl COT from O30, and found that O30 transmitted these same 37 IOAs every 10 seconds. Periodic transmission of data as seen by this event can be essential in modeling intrusion detecting system, which have been proposed previously by several papers [1], [2], [6].…”

“…To our best knowledge, this paper presents the first measurement study of a real-world IEC 104 network used for coordinating AGC in a live system. All previous studies of IEC 104 have been done either with emulated networks or testbeds [6], [7].…”

Softwarization of SCADA: Lightweight Statistical SDN-Agents for Anomaly Detection

“…By using entropy in Equation 1, which measures the amount of disorder in the observed data, and taking into account the peculiarities of traffic pattern in SCADA systems, it is possible to detect even small deviations from the reference state, and to differentiate regular behavior from that when under attack. Furthermore, the particular characteristics of the SCADA-generated traffic, specifically its periodic shape [12], allow us to retain the observation data from one normal day for a long time, without the need for frequent updates and recalculation of the reference probability distribution Q(x).…”