Accurate modeling of Modbus/TCP for intrusion detection in SCADA systems

International Journal of Critical Infrastructure Protection

Volumn 6, Issue 2, 2013, Pages 63-75

  Goldenberg, Niv ^a   Wool, Avishai ^a  

^a TEL AVIV UNIVERSITY   (Israel)

Author keywords

Modbus TCP; Network intrusion detection system; SCADA systems

Indexed keywords

ACCURATE MODELING; DETERMINISTIC FINITE AUTOMATA; HUMAN MACHINE INTERFACE; INTRUSION DETECTION APPROACHES; INTRUSION DETECTION SYSTEMS; MODBUS/TCP; MODEL-BASED INTRUSION DETECTION; NETWORK INTRUSION DETECTION SYSTEMS;

COMPUTER CRIME; SCADA SYSTEMS;

INTRUSION DETECTION;

EID: 84879779698     PISSN: 18745482     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.ijcip.2013.05.001     Document Type: Article

References (23)

1. Bellovin S. Security problems in the TCP/IP protocol suite. ACM SIGCOMM Computer Communication Review 1989, 19(2):32-48.
2. L. Briesemeister, S. Cheung, U. Lindqvist, A. Valdes, Detection, correlation and visualization of attacks against critical infrastructure systems, in: Proceedings of the Eighth International Conference on Privacy, Security and Trust, 2010, pp. 17-19.
3. Chen T. Stuxnet, the real start of cyber warfare?. IEEE Network 2010, 24(6):2-3.
4. S. Cheung, B. Dutertre, M. Fong, U. Lindqvist, K. Skinner, A. Valdes, Using model-based intrusion detection for SCADA networks, in: Proceedings of the SCADA Security Scientific Symposium, 2007, pp. 127-134.
5. Core Security Technologies, What is Impacket? Buenos Aires, Argentina, 〈〉, 2003. http://oss.coresecurity.com/projects/impacket.html.
6. Core Security Technologies, What is Pcapy? Buenos Aires, Argentina, 〈〉, 2010. http://oss.coresecurity.com/projects/pcapy.html.
7. Digital Bond, Modbus TCP Rules, Sunrise, Florida, 〈〉. http://www.digitalbond.com/tools/quickdraw/modbus-tcp-rules.
8. W. Gao, T. Morris, B. Reaves, D. Richey, On SCADA control system command and response injection and intrusion detection, presented at the eCrime Researchers Summit, 2010.
9. Genge B., Siaterlis C., Nai Fovino I., Masera M. A cyber-physical experimentation environment for the security analysis of networked industrial control systems. Computers and Electrical Engineering 2012, 38(5):1146-1161.
10. Giani A., Karsai G., Roosta T., Shah A., Sinopoli B., Wiley J. A testbed for secure and robust SCADA systems. ACM SIGBED Review 2008, 5(2):4. Article no. 4.
11. A. Hahn, B. Kregel, M. Govindarasu, J. Fitzpatrick, R. Adnan, S. Sridhar, M. Higdon, Development of the PowerCyber SCADA security testbed, in: Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research, article no. 21, 2010.
12. D. Kang, H. Kim, Development of a testbed and security devices for SCADA communications in an electric power system, in: Proceedings of the Thirty-First International Telecommunications Energy Conference, 2009.
13. M. Mallouhi, Y. Al-Nashif, D. Cox, T. Chadaga, S. Hariri, A testbed for analyzing security of SCADA control systems (TASSCS), in: Proceedings of the IEEE Innovative Smart Grid Technologies Conference, 2011.
14. Modbus-IDA, Modbus Messaging on TCP/IP Implementation Guide V1.0b, Hopkinton, Massachusetts 〈〉, 2006. http://www.modbus.org/docs/Modbus_Messaging_Implementation_Guide_V1_0b.pdf.
15. E. Naess, D. Frincke, A. McKinnon, D. Bakken, Configurable middleware-level intrusion detection for embedded systems, in: Proceedings of the Twenty-Fifth IEEE International Conference on Distributed Computing Systems, 2005, pp. 144-151.
16. I. Nai Fovino, A. Carcano, T. De Lacheze Murel, A. Trombetta, M. Masera, Modbus/DNP3 state-based intrusion detection system, in: Proceedings of the Twenty-Fourth IEEE International Conference on Advanced Information Networking and Applications, 2010, pp. 729-736.
17. M. Roesch, Snort - Lightweight intrusion detection for networks, in: Proceedings of the Thirteenth USENIX Conference on System Administration, 1999, pp. 226-238.
18. SRI International, Event Monitoring Enabling Responses to Anomalous Live Disturbances (EMERALD), Menlo Park, California 〈〉. http://www.csl.sri.com/projects/emerald.
19. C. Tsang, S. Kwong, Multi-agent intrusion detection system for an industrial network using ant colony clustering approach and unsupervised feature extraction, in: Proceedings of the IEEE International Conference on Industrial Technology, 2005, pp. 51-56.
20. A. Valdes, S. Cheung, Communication pattern anomaly detection in process control systems, in: Proceedings of the IEEE Conference on Technologies for Homeland Security, 2009, pp. 22-29.
21. A. Valdes, S. Cheung, Intrusion monitoring in process control systems, in: Proceedings of the Forty-Second Hawaii International Conference on System Sciences, 2009.
22. C. Wang, L. Fang, Y. Dai, A simulation environment for SCADA security analysis and assessment, in: Proceedings of the International Conference on Measuring Technology and Mechatronics, vol. 1, 2010, pp. 342-347.
23. D. Yang, A. Usynin, J. Hines, Anomaly-based intrusion detection for SCADA systems, in: Proceedings of the Fifth International Topical Meeting on Nuclear Plant Instrumentation, Control and Human-Machine Interface Technologies, 2006, pp. 12-16.