HAMIDS: Hierarchical monitoring intrusion detection system for industrial control systems

CPS-SPC 2016 - Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and PrivaCy, co-located with CCS 2016

Volumn , Issue , 2016, Pages 103-111

  Ghaeini, Hamid Reza ^a   Tippenhauer, Nils Ole ^a  

^a SINGAPORE UNIVERSITY OF TECHNOLOGY AND DESIGN   (Singapore)

Author keywords

EtherNet IP; Intrusion detection; SCADA

Indexed keywords

COMPUTER CRIME; CONTROL SYSTEMS; CYBER PHYSICAL SYSTEM; EMBEDDED SYSTEMS; HIERARCHICAL SYSTEMS; INTELLIGENT CONTROL; MONITORING; NETWORK SECURITY;

DISTRIBUTED IMPACT; ETHERNET/IP; INDUSTRIAL CONTROL SYSTEMS; INDUSTRIAL CONTROLS; INTERNATIONAL TEAM; INTRUSION DETECTION SYSTEMS; SCADA; UNIVERSITY OF TECHNOLOGIES;

INTRUSION DETECTION;

EID: 85001858107     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2994487.2994492     Document Type: Conference Paper

References (30)

1. C. Alcaraz, L. Cazorla, and G. Fernandez. Context-awareness using anomaly-based detectors for smart grid domains. In International Conference on Risks and Security of Internet and Systems, pages 17-34. Springer, 2014.
2. R. Berthier and W. H. Sanders. Specification-based intrusion detection for advanced metering infrastructures. In Proceedings of Symposium on Pacific Rim Dependable Computing (PRDC), pages 184-193. IEEE, 2011.
3. A. Carcano, A. Coletta, M. Guglielmi, M. Masera, I. N. Fovino, and A. Trombetta. A multidimensional critical state analysis for detecting intrusions in scada systems. IEEE Transactions on Industrial Informatics, 7(2):179-186, 2011.
4. A. Cardigliano, L. Deri, J. Gasparakis, and F. Fusco. vpf-ring: towards wire-speed network monitoring using virtual machines. In Proceedings of conference on Internet measurement conference, pages 533-548. ACM, 2011.
5. L. Cazorla, C. Alcaraz, and J. Lopez. A three-stage analysis of ids for critical infrastructures. Computers & Security, 55:235-250, 2015.
6. S. Cheung, B. Dutertre, M. Fong, U. Lindqvist, K. Skinner, and A. Valdes. Using model-based intrusion detection for SCADA networks. In Proceedings of the SCADA security scientific symposium, volume 46, pages 1-12, 2007.
7. I. Committee. Manufacturing and control systems security part 1: Models and terminology. Technical report, ISA, 2004.
8. Elastic Co. Elasticsearch. www.elastic.co/products/elasticsearch.
9. I. N. Fovino, A. Coletta, A. Carcano, and M. Masera. Critical state-based filtering system for securing scada network protocols. IEEE Transactions on industrial electronics, 59(10):3943-3950, 2012.
10. B. Genge, D. A. Rusu, and P. Haller. A connection pattern-based approach to detect network traffic anomalies in critical infrastructures. In Proceedings of the Seventh European Workshop on System Security, page 1. ACM, 2014.
11. V. Grigorescu. Brownian web interface for bro logs. https://github.com/grigorescu/Brownian.
12. I. Kiss, B. Genge, and P. Haller. A clustering-based approach to detect cyber attacks in process control systems. In 2015 IEEE 13th International Conference on Industrial Informatics (INDIN), pages 142-148. IEEE, 2015.
13. H. Lin, A. Slagell, C. Di Martino, Z. Kalbarczyk, and R. K. Iyer. Adapting Bro into SCADA: building a specification-based intrusion detection system for the DNP3 protocol. In Proceedings of Cyber Security and Information Intelligence Research Workshop, page 5. ACM, 2013.
14. H. Lin, A. Slagell, Z. Kalbarczyk, P. W. Sauer, and R. K. Iyer. Semantic security analysis of scada networks to detect malicious control commands in power grids. In Proceedings of the workshop on Smart energy grid security, pages 29-34. ACM, 2013.
15. O. Linda, T. Vollmer, and M. Manic. Neural network based intrusion detection system for critical infrastructures. In Neural Networks, 2009. IJCNN 2009. International Joint Conference on, pages 1827-1834. IEEE, 2009.
16. A. Mathur and N. O. Tippenhauer. A water treatment testbed for research and training on ICS security. In Proceedings of Workshop on Cyber-Physical Systems for Smart Water Networks (CySWater), 2016.
17. D. Maynor. Metasploit toolkit for penetration testing, exploit development, and vulnerability research. Elsevier, 2011.
18. S. McLaughlin, C. Konstantinou, X. Wang, L. Davi, A.-R. Sadeghi, M. Maniatakos, and R. Karri. The cybersecurity landscape in industrial control systems. Proceedings of the IEEE, 104(5):1039-1057, 2016.
19. R. Mitchell and I.-R. Chen. A survey of intrusion detection techniques for cyber-physical systems. ACM Computing Surveys (CSUR), 46(4):55, 2014.
20. L. Obregon. Secure architecture for industrial control systems. SANS Institute InfoSec Reading Room, 2015.
21. ODVA. EtherNet/IP. Available at: https://www.odva.org/, 2016.
22. V. Paxson. Bro: a System for Detecting Network Intruders in Real-Time. Computer Networks, 31(23-24):2435-2463, 1999.
23. V. Paxson. Bro: A system for detecting network intruders in real-time. Comput. Netw., 31(23-24):2435-2463, Dec. 1999.
24. F. Risso and L. Degioanni. An architecture for high performance network analysis. In Computers and Communications, 2001. Proceedings. Sixth IEEE Symposium on, pages 686-693. IEEE, 2001.
25. M. Roesch et al. Snort: Lightweight intrusion detection for networks. In LISA, volume 99, pages 229-238, 1999.
26. A.-R. Sadeghi, C. Wachsmann, and M. Waidner. Security and privacy challenges in industrial internet of things. In Proceedings of the Annual Design Automation Conference (DAC), pages 54:1-54:6, New York, NY, USA, 2015. ACM.
27. Security Matters. Silentdefense ics. www.secmatters.com/products-ics.
28. R. Udd, M. Asplund, S. Nadjm-Tehrani, M. Kazemtabrizi, and M. Ekstedt. Exploiting bro for intrusion detection in a SCADA system. In Proceedings of Cyber-Physical System Security Workshop (CPSS), 2016.
29. D. Urbina, J. Giraldo, N. O. Tippenhauer, and A. Cárdenas. Attacking fieldbus communications in ICS: Applications to the SWaT testbed. In Proceedings of Singapore Cyber Security Conference (SG-CRC), Jan. 2016.
30. S. Yasakethu and J. Jiang. Intrusion detection via machine learning for scada system protection. In Proceedings of Symposium on ICS & SCADA Cyber Security Research, pages 101-105. BCS, 2013.