Distributed intrusion detection system for SCADA protocols

IFIP Advances in Information and Communication Technology

Volumn 342 AICT, Issue , 2010, Pages 95-110

  Fovino, Igor Nai ^a   Masera, Marcelo ^a   Guglielmi, Michele ^a   Carcano, Andrea ^a   Trombetta, Alberto ^a  

^a NONE

Author keywords

Industrial control systems; intrusion detection; SCADA protocols

Indexed keywords

CRITICAL STATE; DISTRIBUTED INTRUSION DETECTION SYSTEMS; EVENT CORRELATION; INDUSTRIAL CONTROL SYSTEMS; INTRUSION DETECTION APPROACHES; PROTOTYPE IMPLEMENTATIONS; SCADA PROTOCOLS;

COMPUTER CRIME; CONTROL THEORY; CRITICAL CURRENT DENSITY (SUPERCONDUCTIVITY); INDUSTRY; PUBLIC WORKS; REMOTE CONTROL; SCADA SYSTEMS;

INTRUSION DETECTION;

EID: 78651107078     PISSN: 18684238     EISSN: None     Source Type: Book Series    
DOI: 10.1007/978-3-642-16806-2_7     Document Type: Conference Paper

References (16)

1. A. Carcano, I. Nai Fovino,M.Masera and A. Trombetta, SCADA malware: A proof of concept, presented at the Third International Workshop on Critical Information Infrastructure Security, 2008.
2. F. Cuppens and A. Miege, Alert correlation in a cooperative intrusion detection framework, Proceedings of the IEEE Symposium on Security and Privacy, pp. 202-215, 2002.
3. D. Denning, An intrusion-detection model, IEEE Transactions on Software Engineering, vol. 13(2), pp. 222-232, 1987.
4. Digital Bond, ModbusTCPIDS signatures, Sunrise, Florida (www.digitalb ond.com/index.php/research/ids-signatures/modbus-tcp-ids-signatures).
5. G. Dondossola, J. Szanto, M. Masera and I. Nai Fovino, Effects of intentional threats to power substation control systems, International Journal of Critical Infrastructures, vol. 4(1/2), pp. 129-143, 2008.
6. P. Gross, J. Parekh and G. Kaiser, Secure selecticast for collaborative intrusion detection systems, Proceedings of the International Workshop on Distributed Event-Based Systems, 2004.
7. M. Masera and I. Nai Fovino, Modeling information assets for security risk assessment in industrial settings, Proceedings of the Fifteenth EICAR Annual Conference, 2006.
8. M. Masera and I. Nai Fovino, Models for security assessment and management, Proceedings of the International Workshop on Complex Network and Infrastructure Protection, 2006.
9. M. Masera and I. Nai Fovino, A service-oriented approach for assessing infrastructure security, in Critical Infrastructure Protection, E. Goetz and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 367-379, 2007.
10. M. Masera, I. Nai Fovino and R. Leszczyna, Security assessment of a turbogas power plant, in Critical Infrastructure Protection II, M. Papa and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 31-40, 2008.
11. Modbus IDA, MODBUS Application Protocol Specification v1.1a, North Grafton, Massachusetts (www.modbus.org/specs.php), June 4, 2004.
12. Modbus IDA, MODBUS Messaging on TCP/IP Implementation Guide v1.0a, North Grafton, Massachusetts (www.modbus.org/specs.php), June 4, 2004.
13. Modbus.org, MODBUS over Serial Line Specification and Implementation Guide v1.0, North Grafton, Massachusetts (www. modbus.org/specs.php), February 12, 2002.
14. I. Nai Fovino and M. Masera, Emergent disservices in interdependent systems and system-of-systems, Proceedings of the IEEE Conference on Systems, Man and Cybernetics, vol. 1, pp. 590-595, 2006.
15. P. Ning, Y. Cui and D. Reeves, Constructing attack scenarios through correlation of intrusion alerts, Proceedings of the Ninth ACM Conference on Computer and Communications Security, pp. 245-254, 2002.
16. V. Yegneswaran, P. Barford and S. Jha, Global intrusion detection in the DOMINO overlay system, Proceedings of the Network and Distributed System Security Symposium, 2004.