Bro in SCADA: dynamic intrusion detection policies based on a system model

Justyna J. Chromik, Anne Remke, Boudewijn R. Haverkort

Research output: Other contribution

Abstract

We present an online monitoring tool for SCADA systems based on the network monitor Bro, which can be used locally at eld stations. The tool generates alerts when suspicious and erroneous commands and sensor readings are detected. It can hence be seen as a local Intrusion Detection System, as well as a safety enhancement. It maintains a model of the local system, which is updated with incoming packets containing sensor readings and commands. Focusing on the protocol IEC-104, a parser was developed and the packet content was directly fed into the system model. Adaptive policies are implemented in Bro, which formulate physical constraints and safety requirements and allow to check whether SCADA trac complies to these rules in real time. A case study with a real IEC-104 trac trace shows the feasibility of our approach.
Original languageEnglish
PublisherBCS Learning & Development Ltd.
Number of pages10
Place of PublicationHamburg
ISBN (Print)978-1-78017-454-9
Publication statusPublished - 30 Aug 2018
Externally publishedYes

Fingerprint

Intrusion detection
SCADA systems
Sensors
Monitoring

Keywords

  • Intrusion detection system
  • Process-aware
  • SCADA
  • IDS
  • Power distribution

Cite this

Chromik, J. J., Remke, A., & Haverkort, B. R. (2018, Aug 30). Bro in SCADA: dynamic intrusion detection policies based on a system model. Hamburg: BCS Learning & Development Ltd.
Chromik, Justyna J. ; Remke, Anne ; Haverkort, Boudewijn R. / Bro in SCADA : dynamic intrusion detection policies based on a system model. 2018. Hamburg : BCS Learning & Development Ltd. 10 p.
@misc{91259603f23e48d9abd3c9aed7a92a88,
title = "Bro in SCADA: dynamic intrusion detection policies based on a system model",
abstract = "We present an online monitoring tool for SCADA systems based on the network monitor Bro, which can be used locally at eld stations. The tool generates alerts when suspicious and erroneous commands and sensor readings are detected. It can hence be seen as a local Intrusion Detection System, as well as a safety enhancement. It maintains a model of the local system, which is updated with incoming packets containing sensor readings and commands. Focusing on the protocol IEC-104, a parser was developed and the packet content was directly fed into the system model. Adaptive policies are implemented in Bro, which formulate physical constraints and safety requirements and allow to check whether SCADA trac complies to these rules in real time. A case study with a real IEC-104 trac trace shows the feasibility of our approach.",
keywords = "Intrusion detection system, Process-aware, SCADA, IDS, Power distribution",
author = "Chromik, {Justyna J.} and Anne Remke and Haverkort, {Boudewijn R.}",
year = "2018",
month = "8",
day = "30",
language = "English",
isbn = "978-1-78017-454-9",
publisher = "BCS Learning & Development Ltd.",
type = "Other",

}

Chromik, JJ, Remke, A & Haverkort, BR 2018, Bro in SCADA: dynamic intrusion detection policies based on a system model. BCS Learning & Development Ltd., Hamburg.

Bro in SCADA : dynamic intrusion detection policies based on a system model. / Chromik, Justyna J.; Remke, Anne; Haverkort, Boudewijn R.

10 p. Hamburg : BCS Learning & Development Ltd.. 2018, .

Research output: Other contribution

TY - GEN

T1 - Bro in SCADA

T2 - dynamic intrusion detection policies based on a system model

AU - Chromik, Justyna J.

AU - Remke, Anne

AU - Haverkort, Boudewijn R.

PY - 2018/8/30

Y1 - 2018/8/30

N2 - We present an online monitoring tool for SCADA systems based on the network monitor Bro, which can be used locally at eld stations. The tool generates alerts when suspicious and erroneous commands and sensor readings are detected. It can hence be seen as a local Intrusion Detection System, as well as a safety enhancement. It maintains a model of the local system, which is updated with incoming packets containing sensor readings and commands. Focusing on the protocol IEC-104, a parser was developed and the packet content was directly fed into the system model. Adaptive policies are implemented in Bro, which formulate physical constraints and safety requirements and allow to check whether SCADA trac complies to these rules in real time. A case study with a real IEC-104 trac trace shows the feasibility of our approach.

AB - We present an online monitoring tool for SCADA systems based on the network monitor Bro, which can be used locally at eld stations. The tool generates alerts when suspicious and erroneous commands and sensor readings are detected. It can hence be seen as a local Intrusion Detection System, as well as a safety enhancement. It maintains a model of the local system, which is updated with incoming packets containing sensor readings and commands. Focusing on the protocol IEC-104, a parser was developed and the packet content was directly fed into the system model. Adaptive policies are implemented in Bro, which formulate physical constraints and safety requirements and allow to check whether SCADA trac complies to these rules in real time. A case study with a real IEC-104 trac trace shows the feasibility of our approach.

KW - Intrusion detection system

KW - Process-aware

KW - SCADA

KW - IDS

KW - Power distribution

M3 - Other contribution

SN - 978-1-78017-454-9

PB - BCS Learning & Development Ltd.

CY - Hamburg

ER -