A multidimensional critical state analysis for detecting intrusions in SCADA systems

IEEE Transactions on Industrial Informatics

Volumn 7, Issue 2, 2011, Pages 179-186

  Carcano, A ^a   Coletta, A ^b   Guglielmi, M ^a   Masera, M ^b   Nai Fovino, I ^b   Trombetta, A ^a  

^a UNIVERSITY OF INSUBRIA   (Italy)

^b JOINT RESEARCH CENTRE   (Italy)

Author keywords

Critical states; intrusion detection; supervisory control and data acquisition (SCADA) systems

Indexed keywords

CLASSIC MODELS; CRITICAL STATE; DETECTION APPROACH; INDUSTRIAL INSTALLATIONS; INFORMATION AND COMMUNICATIONS TECHNOLOGY; INNOVATIVE APPROACHES; INTRUSION DETECTION SYSTEMS; ISOLATED SYSTEMS; NUCLEAR PLANT; SECURITY COUNTERMEASURES; SUPERVISORY CONTROL AND DATA ACQUISITION (SCADA) SYSTEMS; SUPERVISORY CONTROL AND DATA ACQUISITION SYSTEMS; SYSTEM-OF-SYSTEMS; THEORETICAL FRAMEWORK;

COMPUTER SYSTEM FIREWALLS; COMPUTER VIRUSES; CRITICAL CURRENT DENSITY (SUPERCONDUCTIVITY); CRITICAL INFRASTRUCTURES; INDUSTRIAL PLANTS; INFORMATION TECHNOLOGY; INTRUSION DETECTION; VIRUSES;

SCADA SYSTEMS;

EID: 79955867639     PISSN: 15513203     EISSN: None     Source Type: Journal    
DOI: 10.1109/TII.2010.2099234     Document Type: Article

References (16)

1. I. Nai Fovino, A. Carcano, M. Masera, and A. Trombetta, "An experimental investigation of malware attacks on SCADA systems," Int. J. Critical Infrastructure Protection, vol. 2, no. 4, 2009.
2. [Online]. Available: http://www.digitalbond.com/index.php/research/ ids-signatures/modbus-tcp-ids-signatures/ last access 30/04/2010
3. P. Gross, J. Parekh, and G. Kaiser, "Secure selecticast for collaborative intrusion detection systems," in Proc. Int. Workshop on DEBS, 2004.
4. Modbus-IDA, "Modbus Application Protocol Specification v1.1b." [Online]. Available: http://www.modbus.org December 28, 2006
5. F. Cuppens and A. Miège, "Alert correlation in a cooperative intrusion detection framework," in Proc. 2002 IEEE Symp. Security and Privacy, Washington, DC, 2002, p. 202.
6. P. Ning, Y. Cui, and D. S. Reeves, "Constructing attack scenarios through correlation of intrusion alerts," in Proc. ACM Conf. Comput. Commun. Security, Washington, D.C., Nov. 2002, pp. 245-254.
7. S. Slay and M. Miller, Lessons Learned from the Maroochy Water Breach, E. Goetz and S. Shenoi, Eds. New York: Springer, 2008, vol. 253, Critical Infrastructure Protection, pp. 73-82, IFIP International Federation for Information Processing.
8. I. Nai Fovino, M. Masera, L. Guidi, and G. Carpi, "An experimental platform for assessing SCADA vulnerabilities and countermeasures in power plants," in Proc. IEEE 3rd Int. Conf. Human System Interaction, Rzeszow, Poland, May 13-15, 2010, pp. 679-686.
9. S. East, J. Butts, M. Papa, and S. Shenoi, A Taxonomy of Attacks on the DNP3 Protocol.. New York: Springer, vol. 311/2009, pp. 67-81, 1868-4238, IFIP Advances in Information and Communication Technology.
10. I. Nai Fovino, A. Carcano, M. Masera, A. Trombetta, and T. Delacheze-Murel, "Modbus/DNP3 state-based intrusion detection system," in Proc. 24th Int. Conf. Advanced Information Networking and Applications, Perth, Australia, Apr. 20-23, 2010, pp. 729-736.
11. G. Clarke and D. Reynders, Modern SCADA Protocols. New York: Elsevier, 2004, 0750657995.
12. R. Isermann, "Supervision, fault-detection and fault-diagnosis methods. An introduction," Control Engineering Practice, vol. 5, no. 5, pp. 639-652, 1997. (Pubitemid 27414356)
13. R. Isermann, "Process fault detection based on modelling and estimation methods-A survey," Automatica, vol. 20, no. 4, pp. 1287-1298, 1984.
14. P. M. Frank, "Advanced fault detection and isolation schemes using non linear and robust observers," in 10th IFAC Congress, Munich, Germany, 1987, vol. 3, pp. 63-68.
15. C. Dominguez, M. Vidulich, E. Vogel, and G. McMillan, Situation Awareness: Papers and Annotated Bibliography, Armstrong Laboratory, Human System Center, ref. AL/CF-TR-1994-0085, 1994.
16. R. Roman, C. Alcaraz, and J. Lopez, "The role of wireless sensor networks in the area of critical information infrastructure protection," Inf. Secur. Tech. Rep., vol. 12, no. 1, pp. 24-31, 2007. (Pubitemid 46829995)