An Efficient Data-Driven Clustering Technique to Detect Attacks in SCADA Systems

IEEE Transactions on Information Forensics and Security

Volumn 11, Issue 5, 2016, Pages 893-906

  Almalawi, Abdulmohsen ^a   Fahad, Adil ^b   Tari, Zahir ^c   Alamri, Abdullah ^d   Alghamdi, Rayed ^a   Zomaya, Albert Y ^e  

^a KING ABDULAZIZ UNIVERSITY   (Saudi Arabia)

^b AL BAHA UNIVERSITY   (Saudi Arabia)

^c RMIT UNIVERSITY   (Australia)

^d UNIVERSITY OF JEDDAH   (Saudi Arabia)

^e UNIVERSITY OF SYDNEY   (Australia)

Author keywords

[No Author keywords available]

Indexed keywords

CLUSTER ANALYSIS; COMPUTER SYSTEM FIREWALLS; COMPUTER VIRUSES; DATA ACQUISITION; ELECTRIC POWER SYSTEM CONTROL; INTRUSION DETECTION; MERCURY (METAL); WATER DISTRIBUTION SYSTEMS; WATER SUPPLY SYSTEMS;

ANTIVIRUS SOFTWARES; CLUSTERING TECHNIQUES; INTRUSION DETECTION APPROACHES; INTRUSION DETECTION SYSTEMS; MONITORING PURPOSE; PROCESS PARAMETERS; PROPRIETARY SOFTWARE; SUPERVISORY CONTROL AND DATAACQUISITION SYSTEMS (SCADA);

SCADA SYSTEMS;

EID: 84963934385     PISSN: 15566013     EISSN: None     Source Type: Journal    
DOI: 10.1109/TIFS.2015.2512522     Document Type: Article

References (38)

1. J. Slay and M. Miller, "Lessons learned from the Maroochy water breach," in Critical Infrastructure Protection, vol. 253. Boston, MA, USA: Springer, 2007, pp. 73-82.
2. I. N. Fovino, A. Carcano, M. Masera, A. Trombetta, "An experimental investigation of malware attacks on SCADA systems," Int. J. Critical Infrastruct. Protect., vol. 2, no. 4, pp. 139-145, Dec. 2009.
3. I. N. Fovino, A. Carcano, T. De Lacheze Murel, A. Trombetta, M. Masera, "ModBus/DNP3 state-based intrusion detection system," in Proc. 24th IEEE Int. Conf. Adv. Inf. Netw. Appl. (AINA), Apr. 2010, pp. 729-736.
4. A. Carcano, A. Coletta, M. Guglielmi, M. Masera, I. N. Fovino, A. Trombetta, "A multidimensional critical state analysis for detecting intrusions in SCADA systems," IEEE Trans. Ind. Informat., vol. 7, no. 2, pp. 179-186, May 2011.
5. I. N. Fovino, A. Coletta, A. Carcano, M. Masera, "Critical statebased filtering system for securing SCADA network protocols," IEEE Trans. Ind. Electron., vol. 59, no. 10, pp. 3943-3950, Oct. 2012.
6. W. Yang and J. Jiang, "Wind turbine condition monitoring and reliability analysis by SCADA information," in Proc. 2nd Int. Conf. Mech. Autom. Control Eng. (MACE), Jul. 2011, pp. 1872-1875.
7. X. Jin, J. Bigham, J. Rodaway, D. Gamez, C. Phillips, "Anomaly detection in electricity cyber infrastructures," in Proc. Int. Workshop Complex Netw. Infrastruct. Protect. (CNIP), 2006, pp. 1-12.
8. J. L. Rrushi, "Composite intrusion detection in process control networks," Ph.D. dissertation, Dept. Comput. Sci., Univ. Milan, Milan, Italy, Apr. 2009.
9. I. Marton, A. I. Sánchez, S. Carlos, S. Martorell, "Application of data driven methods for condition monitoring maintenance," Chem. Eng. Trans., vol. 33, pp. 301-306, 2013.
10. W. Gao, T. Morris, B. Reaves, D. Richey, "On SCADA control system command and response injection and intrusion detection," in Proc. eCrime Res. Summit (eCrime), 2010, pp. 1-9.
11. A. Zaher, S. D. J. McArthur, D. G. Infield, Y. Patel, "Online wind turbine fault detection through automated SCADA data analysis," Wind Energy, vol. 12, no. 6, pp. 574-593, 2009.
12. L. Maglaras, J. Jiang, T. J. Cruz, "Integrated ocsvm mechanism for intrusion detection in SCADA systems," Electron. Lett., vol. 50, no. 25, pp. 1935-1936, 2014.
13. L. A. Maglaras and J. Jiang, "A real time OCSVM intrusion detection module with low overhead for SCADA systems," Int. J. Adv. Res. Artif. Intell., vol. 3, no. 10, pp. 45-51, 2014.
14. O. Linda, T. Vollmer, M. Manic, "Neural network based intrusion detection system for critical infrastructures," in Proc. Int. Joint Conf. Neural Netw. (IJCNN), Jun. 2009, pp. 1827-1834.
15. S. Cheung, B. Dutertre, M. Fong, U. Lindqvist, K. Skinner, A. Valdes, "Using model-based intrusion detection for SCADA networks," in Proc. SCADA Secur. Sci. Symp., 2007, pp. 127-134.
16. A. Valdes and S. Cheung, "Communication pattern anomaly detection in process control systems," in Proc. IEEE Conf. Technol. Homeland Secur. (HST), May 2009, pp. 22-29.
17. C. Alcaraz and J. Lopez, "WASAM: A dynamic wide-area situational awareness model for critical domains in smart grids," Future Generat. Comput. Syst., vol. 30, pp. 146-154, Jan. 2014.
18. C. Alcaraz and J. Lopez, "Diagnosis mechanism for accurate monitoring in critical infrastructure protection," Comput. Standards Interfaces, vol. 36, no. 3, pp. 501-512, 2014.
19. L. Portnoy, E. Eskin, S. Stolfo, "Intrusion detection with unlabeled data using clustering," in Proc. ACM CSS Workshop Data Mining Appl. Secur. (DMSA), 2001, pp. 5-8.
20. A. Almalawi, X. Yu, Z. Tari, A. Fahad, I. Khalil, "An unsupervised anomaly-based detection approach for integrity attacks on SCADA systems," Comput. Secur., vol. 46, pp. 94-110, Oct. 2014.
21. C. D. Manning, H. Schütze, P. Raghavan, Introduction to Information Retrieval, vol. 1. Cambridge, U.K.: Cambridge Univ. Press, 2008.
22. A. Frank and A. Asuncion. (2010). UCI machine learning repository. School Inf. Comput. Sci., Univ. California, Irvine, Irvine, CA, USA. [Online]. Available: http://archive.ics.uci.edu/ml
23. S. Suthaharan, M. Alzahrani, S. Rajasegarar, C. Leckie, M. Palaniswami, "Labelled data collection for anomaly detection in wireless sensor networks," in Proc. 6th Int. Conf. Intell. Sensors, Sensor Netw. Inf. Process. (ISSNIP), Dec. 2010, pp. 269-274.
24. ModBus/TCP Simulator. [Online]. Available: http://www.modbustools. com, accessed Nov. 2011.
25. ModBus Messaging on TCP/IP Implementation Guide V1.0a, Modbus-IDA, North Grafton, MA, USA, Jun. 2004.
26. Software That Models the Hydraulic and Water Quality Behavior of Water Distribution Piping Systems. [Online]. Available: http://www.epa. gov/nrmrl/wswrd/dw/epanet.html, accessed Nov. 2011.
27. Daily Residential Water Use for Melbourne. [Online]. Available: http://www.melbournewater.com.au, accessed Nov. 2011.
28. A. Almalawi, Z. Tari, I. Khalil, A. Fahad, "SCADAVT-A framework for SCADA security testbed based on virtualization technology," in Proc. IEEE 38th Conf. Local Comput. Netw. (LCN), Oct. 2013, pp. 639-646.
29. R. T. Ng and J. Han, "Efficient and effective clustering methods for spatial data mining," in Proc. 20th Int. Conf. Very Large Data Bases, 1994, pp. 144-155.
30. T. Zhang, R. Ramakrishnan, M. Livny, "BIRCH: An efficient data clustering method for very large databases," ACM SIGMOD Rec., vol. 25, pp. 103-114, Jun. 1996.
31. G. Sheikholeslami, S. Chatterjee, A. Zhang, "WaveCluster: A wavelet-based clustering approach for spatial data in very large databases," in Proc. 24th Int. Conf. Very Large Data Bases, 1998, pp. 428-439.
32. W. Wang, J. Yang, R. R. Muntz, "STING: A statistical information grid approach to spatial data mining," in Proc. 23rd Int. Conf. Very Large Data Bases, Feb. 1997, pp. 186-195.
33. M. Ester, H.-P. Kriegel, J. Sander, X. Xu, "A density based algorithm for discovering clusters in large spatial databases with noise," in Proc. KDD, vol. 7. 1996, pp. 226-231.
34. M. M. Breunig, H.-P. Kriegel, R. T. Ng, J. Sander, "LOF: Identifying density-based local outliers," in Proc. ACM SIGMOD Int. Conf. Manage. Data (SIGMOD), 2000, pp. 93-104.
35. M. M. Breunig, H.-P. Kriegel, R. T. Ng, J. Sander, "OPTICS-OF: Identifying local outliers," in Proc. 3rd Eur. Conf. Principles Data Mining Knowl. Discovery, 1999, pp. 262-270.
36. W. Jin, A. K. H. Tung, J. Han, "Mining top-n local outliers in large databases," in Proc. 7th ACM SIGKDD Int. Conf. Knowl. Discovery Data Mining, 2001, pp. 293-298.
37. V. Šaltenis, "Outlier detection based on the distribution of distances between data points," Informatica, vol. 15, no. 3, pp. 399-410, Aug. 2004.
38. A. Arning, R. Agrawal, P. Raghavan, "A linear method for deviation detection in large databases," in Proc. Knowl. Discovery Data Mining (KDD), Aug. 1996, pp. 164-169.