A Cybersecurity Detection Framework for Supervisory Control and Data Acquisition Systems

IEEE Transactions on Industrial Informatics

Volumn 12, Issue 6, 2016, Pages 2236-2246

  Cruz, Tiago ^a   Rosa, Luis ^a   Proenca, Jorge ^a   Maglaras, Leandros ^b   Aubigny, Matthieu ^c   Lev, Leonid ^d   Jiang, Jianmin ^e   Simões, Paulo ^a  

^a UNIVERSITY OF COIMBRA   (Portugal)

^b DE MONTFORT UNIVERSITY   (United Kingdom)

^c Ecostart Bât 2   (Luxembourg)

^d ISRAEL ELECTRIC CORPORATION   (Israel)

^e SHENZHEN UNIVERSITY   (China)

Author keywords

Critical infrastructure (CI) protection; industrial control systems (ICS); intrusion detection systems (IDS); supervisory control and data acquisition (SCADA)

Indexed keywords

COMPUTER CRIME; CONTROL SYSTEMS; DATA ACQUISITION; INTELLIGENT CONTROL; INTRUSION DETECTION; MERCURY (METAL); NETWORK SECURITY;

DETECTION FRAMEWORK; DISTRIBUTED INTRUSION DETECTION SYSTEMS; ELECTRICAL DISTRIBUTION; INDUSTRIAL CONTROL SYSTEMS; INTRUSION DETECTION SYSTEMS; ITS ARCHITECTURE; SUPERVISORY CONTROL AND DATA ACQUISITION; SYSTEM EVALUATION;

SCADA SYSTEMS;

EID: 85006762171     PISSN: 15513203     EISSN: None     Source Type: Journal    
DOI: 10.1109/TII.2016.2599841     Document Type: Article

References (25)

1. T. Strasser et al., "A review of architectures and concepts for intelligence in future electric energy systems," IEEE Trans. Ind. Electron., vol. 62, no. 4, pp. 2424-2438, Apr. 2015.
2. C.-S. Cho, W.-H. Chung, and S.-Y. Kuo, "Cyberphysical security and dependability analysis of digital control systems in nuclear power plants," IEEE Trans. Syst., Man, Cybern.: Syst., vol. 46, no. 3, pp. 356-369, Mar. 2016.
3. R. Mitchell and I.-R. Chen, "A survey of intrusion detection techniques for cyber-physical systems," ACM Comput. Surv., vol. 46, no. 4, pp. 55:1-55:29, Mar. 2014.
4. A. Nicholson, S. Webber, S. Dyer, T. Patel, and H. Janicke, "SCADA security in the light of cyber-warfare," Comput. Secur., vol. 31, no. 4, pp. 418-436, 2012.
5. D. Kushner, "The real story of Stuxnet," IEEE Spectrum, vol. 50, no. 3, pp. 48-53, Mar. 2013.
6. Security for Industrial Automation and Control Systems - Part 1: Terminology, Concepts, and Models, ANSI/ISA-99.00.01-2007, 2007.
7. B. Zhu, A. Joseph, and S. Sastry, "A taxonomy of cyber attacks on SCADAsystems," in Proc. 4th Int. Conf. Cyber, Phys. Soc. Comput., 2011, pp. 380-388.
8. D. Kang, J. Lee, B. Kim, and D. Hur, "Proposal strategies of key management for data encryption in SCADA network of electric power systems," Int. J. Electr. Power Energy Syst., vol. 33, no. 9, pp. 1521-1526, 2011.
9. A. Rezai, P. Keshavarzi, and Z. Moravej, "Secure SCADA communication by using a modified key management scheme," ISA Trans., vol. 52, no. 4, pp. 517-524, 2013.
10. G. Dan, H. Sandberg, M. Ekstedt, and G. Bjorkman, "Challenges in power system information security," IEEE Security Priv., vol. 10, no. 4, pp. 62-70, Jul./Aug. 2012.
11. K. Stouffer, S. Lightman, V. Pillitter, M. Abrams, and A. Hahn, "Guide to industrial control system (ICS) security, revision 2 (NIST SP 800-82)," NIST, Gaithersburg, MD, USA, Tech. Rep. 800-82, 2015.
12. Cyber Security, NERC Standards CIP-002-009, North Amer. Electr. Rel. Council, Atlanta, GA, USA, 2013. [Online]. Available: http://www. nerc.com
13. United States Nuclear Regulatory Commission. 73.54 Protection of Digital Computer and Communication Systems and Networks, 2009. [Online]. Available: http://www.nrc.gov/reading-rm/doc collections/cfr/part073/part073-0054.html
14. S. Han, M. Xie, H.-H. Chen, and Y. Ling, "Intrusion detection in cyberphysical systems: Techniques and challenges," IEEE Syst. J., vol. 8, no. 4, pp. 1049-1059, Dec. 2014.
15. R. Karri and J. Rajendran, "Trustworthy hardware: Identifying and classifying hardware trojans," Computer, vol. 43, no. 10, pp. 39-46, 2010.
16. W. Gao, T. Morris, B. Reaves, and D. Richey, "On SCADA control system command and response injection and intrusion detection," in Proc. eCrime Researchers Summit, 2010, pp. 1-9.
17. Y. Yang et al. "Multiattribute SCADA-specific intrusion detection system for power networks," IEEE Trans. Power Del., vol. 29, no. 3, pp. 1092-1102, Jun. 2014.
18. L. Maglaras, J. Jiang, and T. Cruz, "Integrated OCSVM mechanism for intrusion detection in SCADA systems," Electron. Lett., vol. 50, no. 25, pp. 1935-1936, 2014.
19. M. Winn, M. Rice, S. Dunlap, J. Lopez, and B. Mullins, "Constructing cost-effective and targetable industrial control system honeypots for production networks," Int. J. Crit. Infrastructure Protection, vol. 10, pp. 47-58, 2015.
20. S. Yin, X. Zhu, and C. Jing, "Fault detection based on a robust one class support vector machine," Neurocomputing, vol. 145, pp. 263-268, 2014.
21. X. Lu, B. Fan, and M. Huang, "A novel LS-SVM modeling method for a hydraulic press forging process with multiple localized solutions," IEEE Trans. Ind. Informat., vol. 11, no. 3, pp. 663-670, Jun. 2015.
22. P. Simões, T. Cruz, J. Proença, and E. Monteiro, "Specialized honeypots for SCADA systems," in Cyber Security: Analytics, Technology and Automation (ser. Intelligent Systems, Control and Automation: Science and Engineering), vol. 78, M. Lehto and P. Neittaanmäki, Eds. New York, NY, USA: Springer, 2015, pp. 251-269.
23. T. Cruz et al. "Improving network security monitoring for industrial control systems," in Proc. IFIP/IEEE Int. Symp. Integr. Netw. Manage., May 2015, pp. 878-881.
24. L. A. Maglaras, J. Jiang, and T. Cruz, "Combining ensemble methods and social network metrics for improving accuracy of OCSVM on intrusion detection in SCADA systems," J. Inf. Security Appl., 2016. [Online]. Available: http://dx.doi.org/10.1016/j.jisa.2016.04.002.
25. Dept. Homeland Security ICS-CERT, Schneider Electric Modicon Quantum Vulnerabilities (Update b), 2012. [Online]. Available: https://icscert. us-cert.gov/alerts/ICS-ALERT-12-020-03B