Multiattribute SCADA-specific intrusion detection system for power networks

IEEE Transactions on Power Delivery

Volumn 29, Issue 3, 2014, Pages 1092-1102

  Yang, Y ^a,b   McLaughlin, K ^b   Sezer, S ^b   Littler, T ^b   Im, E G ^c   Pranggono, B ^d   Wang, H F ^e  

^a STATE GRID CORPORATION OF CHINA   (China)

^b QUEEN'S UNIVERSITY BELFAST   (United Kingdom)

^c Hanyang University   (South Korea)

^d GLASGOW CALEDONIAN UNIVERSITY   (United Kingdom)

^e NORTH CHINA ELECTRIC POWER UNIVERSITY   (China)

Author keywords

Cybersecurity; intrusion detection; smart grid; supervisory control and data acquisition (SCADA)

Indexed keywords

COMPLEX NETWORKS; COMPUTER CRIME; CONTROL; ELECTRIC POWER TRANSMISSION NETWORKS; INTRUSION DETECTION; SMART POWER GRIDS;

CYBER SECURITY; INTRUSION DETECTION SYSTEMS; MULTIPLE ATTRIBUTES; POWER SYSTEM NETWORKS; SIMULATED ATTACKS; SMART GRID; SUPERVISORY CONTROL AND DATA ACQUISITION; SUPERVISORY CONTROL AND DATAACQUISITION SYSTEMS (SCADA);

SCADA SYSTEMS;

EID: 84901604278     PISSN: 08858977     EISSN: None     Source Type: Journal    
DOI: 10.1109/TPWRD.2014.2300099     Document Type: Article

References (23)

1. Antiy CERT, "Report on the worm Stuxnet's attack," Harbin, China, Tech rep. V3.1 2010-09.29, Sep. 2011.
2. A. A. Ghorbani, W. Lu, and M. Tavallaee, Network Intrusion Detection and Prevention: Concepts and Techniques. London, U.K.: Springer, 2010, pp. 1-20.
3. Z. Yichi, W. Lingfeng, S. Weiqing, R. C. Green, and M. Alam, "Distributed intrusion detection system in a multi-layer network architecture of smart grids," IEEE Trans. SmartGrid, vol. 2, no. 4, pp. 796-808, Dec. 2011.
4. J. Verba and M. Milvich, "Idaho national laboratory supervisory control and data acquisition intrusion detection system (SCADA IDS)," in Proc. IEEE Conf. Technol. Homeland Security, 2008, pp. 469-473.
5. M. P. Coutinho, G. Lambert-Torres, L. E. B. da Silva, H. G. Martins, H. Lazarek, and J. C. Neto, "Anomaly detection in power system control center critical infrastructures using rough classification algorithm," in Proc. IEEE 3rd Int. Conf. Digital Ecosyst. Technol., 2009, pp. 733-738.
6. A. Carcano, A. Coletta, M. Guglielmi, M. Masera, I. N. Fovino, and A. Trombetta, "A multidimensional critical state analysis for detecting intrusions in SCADA systems," IEEE Trans. Ind. Inf., vol. 7, no. 2, pp. 179-186, May 2011.
7. S. Cheung, B. Dutertre, M. Fong, U. Lindqvist, K. Skinner, and A. Valdes, "Using model-based intrusion detection for SCADA networks," in Proc. SCADA Security Scientif. Symp., 2007, pp. 127-134.
8. U. K. Premaratne, J. Samarabandu, T. S. Sidhu, R. Beresh, and T. Jian-Cheng, "An intrusion detection system for IEC61850 automated substations," IEEE Trans. Power Del., vol. 25, no. 4, pp. 2376-2383, Oct. 2010.
9. T. Morris, R. Vaughn, and Y. Dandass, "A retrofit network intrusion detection system for MODBUS RTU and ASCII industrial control systems," in Proc. 45th Hawaii Int. Conf. Syst. Sci., 2012, pp. 2338-2345.
10. C. W. Ten, J. Hong, and C. C. Liu, "Anomaly detection for cybersecurity of the substations," IEEE Trans. Smart Grid, vol. 2, no. 4, pp. 865-873, Dec. 2011.
11. A. Valdes and S. Cheung, "Communication pattern anomaly detection in process control systems," in Proc. IEEE Int. Conf. Technol. Homeland Security, 2009, pp. 22-29.
12. W. Gao, T. Morris, B. Reaves, and D. Richey, "On SCADA control system command and response injection and intrusion detection," in Proc. IEEE eCrime Res. Summit, 2010, pp. 1-9.
13. E. D. Knapp, Industrial Network Security: Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems. New York: Elsevier, 2011, pp. 60-61.
14. J. Hurley, A. Munoz, and S. Sezer, "ITACA: Flexible, scalable network analysis," in Proc. IEEE Int. Conf. Commun. Ind. Forum Exhibit., 2012, pp. 1084-1088.
15. C. L. Abad and R. I. Bonilla, "An analysis on the schemes for detecting and preventing ARP cache poisoning attacks," in Proc. 27th Int. Conf. Distrib. Comput. Syst. Workshops, 2007, p. 60.
16. Z. Trabelsi and K. Shuaib, "Man in the middle intrusion detection," in Proc. IEEE Global Telecommun. Conf., 2006, pp. 1-6.
17. Y. Yang, K. McLaughlin, T. Littler, S. Sezer, E. G. Im, Z. Q. Yao, B. Pranggono, and H. F. Wang, "Man-in-the-middle attack test-bed investigating cyber-security vulnerabilities in smart grid SCADA systems," in Proc. IET Int. Conf. Sustain. Power Gen. Supply, 2012, pp. 1-8.
18. J. C. Foster, Metasploit Toolkit for Penetration Testing, Exploit Development, and Vulnerability Research. Rockland, MA, USA: Syngress, 2007.
19. IEEE Standard Communication Delivery Time Performance Requirements for Electric Power Substation Automation, IEEE Standard 1646-2004, Feb. 2005.
20. IBM, "IBM security QRadar SIEM," Somers, NY, USA, Tech. rep. WGD03021-USEN-00, Jan. 2013.
21. E. Egozcue, D. H. Rodríguez, J. A. Ortiz, V. F. Villar, and L. Tarrafeta, "Smart grid security: Recommendations for Europe andmember states. ENISA". Heraklion, Greece., Jul. 2012. [Online]. Available: http:// www.enisa.europa.eu
22. S. Edgar and A. Burns, "Statistical analysis ofWCET for scheduling," in Proc. IEEE 22nd Real-Time Syst. Symp., 2001, pp. 215-224.
23. I. N. Fovino, A. Carcano, T. De Lacheze Murel, A. Trombetta, and M. Masera, "Modbus/DNP3 state-based intrusion detection system," in Proc. 24th IEEE Int. Conf. Adv. Inf. Netw. Appl., 2010, pp. 729-736.