SENAMI: Selective non-invasive active monitoring for ICS intrusion detection

CPS-SPC 2016 - Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2016

Volumn , Issue , 2016, Pages 23-34

  Jardine, William ^a   Frey, Sylvain ^b   Green, Benjamin ^b   Rashid, Awais ^b  

^a MWR InfoSecurity   (United Kingdom)

^b LANCASTER UNIVERSITY   (United Kingdom)

Author keywords

Active monitoring; Industrial control systems; Intrusion detection systems

Indexed keywords

COMPUTER CRIME; COMPUTER SUPPORTED COOPERATIVE WORK; CONTROL SYSTEMS; EMBEDDED SYSTEMS; INTELLIGENT CONTROL; MERCURY (METAL); PASSIVE NETWORKS;

ACTIVE MONITORING; COMPUTATIONAL OVERHEADS; DETECTION OF ATTACKS; INDUSTRIAL CONTROL SYSTEMS; INTRUSION DETECTION SYSTEMS; PASSIVE NETWORK MONITORING; RISK OF OVERLOADING; TAMPERING ATTACKS;

INTRUSION DETECTION;

EID: 85001820446     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2994487.2994496     Document Type: Conference Paper

References (22)

1. Snort. https://www.snort.org/. [Online: accessed August 1st 2016].
2. W. Abbas, A. Laszka, Y. Vorobeychik, and X. D. Koutsoukos. Scheduling intrusion detection systems in resource-bounded cyber-physical systems. In Proceedings of the First ACM Workshop on Cyber-Physical Systems-Security and/or PrivaCy, CPS-SPC 2015, Denver, Colorado, USA, October 16, 2015, pages 55-66, 2015.
3. R. Antrobus, S. Frey, B. Green, and A. Rashid. Simaticscan: Towards a specialised vulnerability scanner for industrial control systems. In Proceedings of the 4th International Symposium on ICS & SCADA Cyber Security Research (ICS-CSR 2016), ICS-CSR 2016, 2016.
4. M. Caselli, E. Zambon, and F. Kargl. Sequence-aware intrusion detection in industrial control systems. In Proceedings of the 1st ACM Workshop on Cyber-Physical System Security, CPSS 2015, Singapore, Republic of Singapore, April 14 - March 14, 2015, pages 13-24, 2015.
5. R. Di Pietro and L. V. Mancini. Intrusion detection systems, volume 38. Springer Science & Business Media, 2008.
6. Digital Bond. PLCScan, 2016.
7. S. Frey, A. Rashid, A. Zanutto, J. Busby, and K. Szmagalska-Follis. On the role of latent design conditions in cyber-physical systems security. In Proceedings of the 2nd International Workshop on Software Engineering for Smart Cyber-Physical Systems, Austin, Texas, pages 43-46. ACM, 2016.
8. B. für Sicherheit in der Informationstechnik. Die lage der it-sicherheit in deutschland 2014. https://www.bsi.bund.de/DE/Publikationen/Lageberichte/lageberichte-node.html. [Online: accessed May 29th 2015].
9. J. González and M. Papa. Passive scanning in modbus networks. In Critical Infrastructure Protection, Post-Proceedings of the First Annual IFIP Working Group 11.10 International Conference on Critical Infrastructure Protection, Dartmouth College, Hanover, New Hampshire, USA, March 19-21, 2007, pages 175-187, 2007.
10. B. Green, S. Frey, A. Rashid, and D. Hutchison. Testbed diversity as a fundamental principle for effective ICS security research. In Proceedings of the First International Workshop on Security and Resilience of Cyber-Physical Infrastructures (SERECIN), pages 12-15. Lancaster University Technical Report SCC-2016-01, 2016.
11. B. Green, M. Krotofil, and D. Hutchison. Achieving ics resilience and security through granular data flow management. In 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy (CPS-SPC), Austria, Vienna, October 28, 2016, 2016.
12. D. Hadziosmanovic, R. Sommer, E. Zambon, and P. H. Hartel. Through the eye of the PLC: semantic security monitoring for industrial processes. In Proceedings of the 30th Annual Computer Security Applications Conference, ACSAC 2014, New Orleans, LA, USA, December 8-12, 2014, pages 126-135, 2014.
13. Infracritical. Project SHINE findings report. http://www.slideshare.net/BobRadvanovsky/project-shine-findings-report-dated-1oct2014, 2014. Last accessed 12 April 2016.
14. A. Kleinmann and A. Wool. Accurate modeling of the siemens S7 SCADA protocol for intrusion detection and digital forensic. JDFSL, 9(2):37-50, 2014.
15. R. Langner. To kill a centrifuge. http://www.langner.com/en/wp-content/uploads/2013/11/To-kill-a-centrifuge.pdf.
16. R. E. Mahan, J. D. Fluckiger, S. L. Clements, C. Tews, J. R. Burnette, C. A. Goranson, and H. Kirkham. Secure data transfer guidance for industrial control and SCADA systems. Pacific Northwest National Lab (PNNL) Report, http://www.pnnl.gov/main/publications/external/technical-reports/PNNL-20776.pdf, 2011. Last accessed 4 January 2016.
17. K. McLaughlin, S. Sezer, P. Smith, Z. Ma, and F. Skopik. PRECYSE: cyber-attack detection and response for industrial control systems. In 2nd International Symposium for ICS & SCADA Cyber Security Research 2014, ICS-CSR 2014, 11-12 September 2014, St. Pölten, Austria, 2014.
18. S. E. McLaughlin and P. McDaniel. SABOT: specification-based payload generation for programmable logic controllers. In the ACM Conference on Computer and Communications Security, CCS'12, Raleigh, NC, USA, October 16-18, 2012, pages 439-449, 2012.
19. A. Nicholson, H. Janicke, and A. Cau. Position paper: Safety and security monitoring in ICS/SCADA systems. In Proceedings of the 2nd International Symposium on ICS & SCADA Cyber Security Research 2014, ICS-CSR 2014, pages 61-66, UK, 2014. BCS.
20. B. Paske, B. Green, D. Prince, and D. Hutchison. Design and Construction of an Industrial Control System Testbed. In PGNET, pages 151-156, 2014.
21. SANS. Analysis of the cyber attack on the ukrainian power grid. https://ics.sans.org/media/E-ISAC-SANS-Ukraine-DUC-5.pdf. [Online: accessed August 1st 2016].
22. M. Strohmeier, V. Lenders, and I. Martinovic. Intrusion detection for airborne communication using PHY-Layer information. In Detection of Intrusions and Malware, and Vulnerability Assessment - 12th International Conference, DIMVA 2015, Milan, Italy, July 9-10, 2015, Proceedings, pages 67-77, 2015.