Stateful Intrusion Detection for IEC 60870-5-104 SCADA Security

Y. Yang; K. McLaughlin; S. Sezer; Y.B. Yuan; W. Huang

doi:10.1109/PESGM.2014.6939218

Stateful Intrusion Detection for IEC 60870-5-104 SCADA Security

Y. Yang, K. McLaughlin, S. Sezer, Y.B. Yuan, W. Huang

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

33 Citations (Scopus)

2867 Downloads (Pure)

Abstract

Cyber threats in Supervisory Control and Data Acquisition (SCADA) systems have the potential to render physical damage and jeopardize power system operation, safety and stability. SCADA systems were originally designed with little consideration of escalating cyber threats and hence the problem of how to develop robust intrusion detection technologies to tailor the requirements of SCADA is an emerging topic and a big challenge. This paper proposes a stateful Intrusion Detection System (IDS) using a Deep Packet Inspection (DPI) method to improve the cyber-security of SCADA systems using the IEC 60870-5-104 protocol which is tailored for basic telecontrol communications. The proposed stateful protocol analysis approach is presented that is designed specifically for the IEC 60870-5-104 protocol. Finally, the novel intrusion detection approach are implemented and validated.

Original language	English
Title of host publication	2014 IEEE PES General Meeting Conference & Exposition
Pages	1-5
Number of pages	5
DOIs	https://doi.org/10.1109/PESGM.2014.6939218
Publication status	Published - 27 Jul 2014
Event	IEEE Power & Energy Society General Meeting, 2014 (PES 14) - USA, Washington DC, United States Duration: 27 Jul 2014 → 31 Jul 2014

Conference

Conference	IEEE Power & Energy Society General Meeting, 2014 (PES 14)
Country/Territory	United States
City	Washington DC
Period	27/07/2014 → 31/07/2014

Access to Document

10.1109/PESGM.2014.6939218

Stateful Intrusion Detection for IEC 60870-5-104 SCADA Security
© 2014 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Accepted author manuscript, 230 KB

R6358ECI: PRECYSE
Sezer, S. (PI)
01/08/2011 → 28/02/2015
Project: Research
R1118ECI: Centre for Secure Information Technologies (CSIT)
McCanny, J. V. (PI), Cowan, C. (CoI), Crookes, D. (CoI), Fusco, V. (CoI), Linton, D. (CoI), Liu, W. (CoI), Miller, P. (CoI), O'Neill, M. (CoI), Scanlon, W. (CoI) & Sezer, S. (CoI)
01/08/2009 → 30/06/2014
Project: Research

Kieran McLaughlin
- kieran.mclaughlinqub.acuk
Person: Academic

Cite this

@inproceedings{43f58a2a6573462fb1fd655b8fe64220,

title = "Stateful Intrusion Detection for IEC 60870-5-104 SCADA Security",

abstract = "Cyber threats in Supervisory Control and Data Acquisition (SCADA) systems have the potential to render physical damage and jeopardize power system operation, safety and stability. SCADA systems were originally designed with little consideration of escalating cyber threats and hence the problem of how to develop robust intrusion detection technologies to tailor the requirements of SCADA is an emerging topic and a big challenge. This paper proposes a stateful Intrusion Detection System (IDS) using a Deep Packet Inspection (DPI) method to improve the cyber-security of SCADA systems using the IEC 60870-5-104 protocol which is tailored for basic telecontrol communications. The proposed stateful protocol analysis approach is presented that is designed specifically for the IEC 60870-5-104 protocol. Finally, the novel intrusion detection approach are implemented and validated.",

author = "Y. Yang and K. McLaughlin and S. Sezer and Y.B. Yuan and W. Huang",

year = "2014",

month = jul,

day = "27",

doi = "10.1109/PESGM.2014.6939218",

language = "English",

pages = "1--5",

booktitle = "2014 IEEE PES General Meeting Conference & Exposition",

note = "IEEE Power & Energy Society General Meeting, 2014 (PES 14) ; Conference date: 27-07-2014 Through 31-07-2014",

}

TY - GEN

T1 - Stateful Intrusion Detection for IEC 60870-5-104 SCADA Security

AU - Yang, Y.

AU - McLaughlin, K.

AU - Sezer, S.

AU - Yuan, Y.B.

AU - Huang, W.

PY - 2014/7/27

Y1 - 2014/7/27

N2 - Cyber threats in Supervisory Control and Data Acquisition (SCADA) systems have the potential to render physical damage and jeopardize power system operation, safety and stability. SCADA systems were originally designed with little consideration of escalating cyber threats and hence the problem of how to develop robust intrusion detection technologies to tailor the requirements of SCADA is an emerging topic and a big challenge. This paper proposes a stateful Intrusion Detection System (IDS) using a Deep Packet Inspection (DPI) method to improve the cyber-security of SCADA systems using the IEC 60870-5-104 protocol which is tailored for basic telecontrol communications. The proposed stateful protocol analysis approach is presented that is designed specifically for the IEC 60870-5-104 protocol. Finally, the novel intrusion detection approach are implemented and validated.

AB - Cyber threats in Supervisory Control and Data Acquisition (SCADA) systems have the potential to render physical damage and jeopardize power system operation, safety and stability. SCADA systems were originally designed with little consideration of escalating cyber threats and hence the problem of how to develop robust intrusion detection technologies to tailor the requirements of SCADA is an emerging topic and a big challenge. This paper proposes a stateful Intrusion Detection System (IDS) using a Deep Packet Inspection (DPI) method to improve the cyber-security of SCADA systems using the IEC 60870-5-104 protocol which is tailored for basic telecontrol communications. The proposed stateful protocol analysis approach is presented that is designed specifically for the IEC 60870-5-104 protocol. Finally, the novel intrusion detection approach are implemented and validated.

U2 - 10.1109/PESGM.2014.6939218

DO - 10.1109/PESGM.2014.6939218

M3 - Conference contribution

SP - 1

EP - 5

BT - 2014 IEEE PES General Meeting Conference & Exposition

T2 - IEEE Power & Energy Society General Meeting, 2014 (PES 14)

Y2 - 27 July 2014 through 31 July 2014

ER -

Stateful Intrusion Detection for IEC 60870-5-104 SCADA Security

Abstract

Conference

Access to Document

Fingerprint

Projects

R6358ECI: PRECYSE

R1118ECI: Centre for Secure Information Technologies (CSIT)

Profiles

Kieran McLaughlin

Cite this