We present the first technique of passive fingerprinting for Supervisory Control And Data Acquisition (SCADA) networks without Deep Packet Inspection (DPI) and experience on real environment. Unlike existing work, our method does not rely on the functions of a specific product or DPI of the SCADA protocol. Our inference method, which is based on the intrinsic characteristics of SCADA, first identifies the network port used for the SCADA protocol, then consecutively infers the field devices and master server. We evaluated the effectiveness of our method using two network traces collected from a real environment for a month and a half, three days from different CI respectively. This confirmed the ability of our method to capture most of the SCADA with high F-score nearly 1, except for HMIs connected to master server, and demonstrated the practical applicability of the method.
The other applicable existing work is protocol reverse engineering that the process of the inferring the specification of an unknown network protocol @cite_7 . These techniques leverage approach for automatically extracting information of unknown target protocol. Even though they contribute to analysis of unknown network environment and helpful to provide major SCADA protocols, it is difficult to cover for analysis of all our CIs in the field. The main difficulty of this problem is closed SCADA information that cannot be provided in public. These techniques based on assumption that we require enough samples from target environment or classification from other distinct types of protocols. Understandably, our CI network information is not public and some major vendors do not public their SCADA protocol specification and information. Even though, these techniques help to analysis several famous SCADA protocol, but this approach is extremely expensive cost to cover all of environment. As SCADA market grows, our CI environment becomes heterogeneous for SCADA device and network protocol. Considering the possibility that customized protocol from standard also can make different result from identified signatures, our method can be applied complementary for analysis of CI that cannot be covered by protocol reversing efforts.
@cite_7
2586860586 2051343255 179510128 2777654136
Supervisory Control and Data Acquisition (SCADA) systems monitor and control critical infrastructure such as the smart grid. As SCADA systems become increasingly interconnected and adopt more and more cyber-enabled components, the risks of cyber attacks become a major concern. Due to their decentralized organization, peer-to-peer (P2P) botnets are resilient to many existing takedown measures and can be exploited as an effective way to launch cyber attacks on SCADA systems. However, little work has been done to detect P2P botnets in SCADA systems, which carry traffic flows with characteristics significantly different from the Internet. In this paper, we design a P2P-botnet detection method for SCADA systems, leveraging built-in traffic monitoring capabilities of SCADA networking devices. The proposed method consists of two stages. In the first stage, we design a simple feature test to filter out non-P2P hosts, which significantly reduces the data volume for P2P-botnet identification. In the second stage, we jointly consider flow-based and connectivity-based features that effectively set apart bots from benign hosts. We propose to use unsupervised learning for P2P-botnet identification, which not only identifies known P2P botnets but also captures newly emerged ones. Our simulation results show that the proposed system achieves high detection rates with very few false positives. Furthermore, our evaluation shows that the proposed method can detect hosts running P2P SCADA applications that are infected by P2P bots. This paper introduces a novel technique for access by a cognitive Secondary User (SU) to a spectrum with an incumbent Primary User (PU), which uses Type-I Hybrid ARQ. The technique allows the SU to perform selective retransmissions of previously corrupted SU data packets. The temporal redundancy introduced by the primary ARQ protocol and by the selective SU retransmission process can be exploited by the SU receiver to perform Interference Cancellation (IC) over the entire interference pattern, thus creating a "clean" channel for the decoding of the concurrent message. The chain decoding technique, initiated by a successful decoding operation of a SU or PU message, consists in the iterative application of IC, as previously corrupted messages become decodable. Based on this scheme, we design an optimal policy that maximizes the SU throughput under a constraint on the average long-term PU throughput degradation. We show that the optimal policy can be found by first optimizing the SU access policy using a Markov Decision Process formulation, and then applying a chain decoding protocol defined by five basic rules. Such an approach enables a compact state representation of the protocol, and its efficient numerical optimization. Finally, we show by numerical results the throughput benefit of the proposed technique. Protocol reverse engineering has often been a manual process that is considered time-consuming, tedious and error-prone. To address this limitation, a number of solutions have recently been proposed to allow for automatic protocol reverse engineering. Unfortunately, they are either limited in extracting protocol fields due to lack of program semantics in network traces or primitive in only revealing the flat structure of protocol format. In this paper, we present a system called AutoFormat that aims at not only extracting protocol fields with high accuracy, but also revealing the inherently “non-flat”, hierarchical structures of protocol messages. AutoFormat is based on the key insight that different protocol fields in the same message are typically handled in different execution contexts (e.g., the runtime call stack). As such, by monitoring the program execution, we can collect the execution context information for every message byte (annotated with its offset in the entire message) and cluster them to derive the protocol format. We have evaluated our system with more than 30 protocol messages from seven protocols, including two text-based protocols (HTTP and SIP), three binary-based protocols (DHCP, RIP, and OSPF), one hybrid protocol (CIFS SMB), as well as one unknown protocol used by a real-world malware. Our results show that AutoFormat can not only identify individual message fields automatically and with high accuracy (an average 93.4 match ratio compared with Wireshark), but also unveil the structure of the protocol format by revealing possible relations (e.g., sequential, parallel, and hierarchical) among the message fields. ∗Part of this research has been supported by the National Science Foundation under grants CNS-0716376 and CNS-0716444. The bulk of this work was performed when the first author was visiting George Mason University in Summer 2007. We introduce scGAN, a novel extension of conditional Generative Adversarial Networks (GAN) tailored for the challenging problem of shadow detection in images. Previous methods for shadow detection focus on learning the local appearance of shadow regions, while using limited local context reasoning in the form of pairwise potentials in a Conditional Random Field. In contrast, the proposed adversarial approach is able to model higher level relationships and global scene characteristics. We train a shadow detector that corresponds to the generator of a conditional GAN, and augment its shadow accuracy by combining the typical GAN loss with a data loss term. Due to the unbalanced distribution of the shadow labels, we use weighted cross entropy. With the standard GAN architecture, properly setting the weight for the cross entropy would require training multiple GANs, a computationally expensive grid procedure. In scGAN, we introduce an additional sensitivity parameter w to the generator. The proposed approach effectively parameterizes the loss of the trained detector. The resulting shadow detector is a single network that can generate shadow maps corresponding to different sensitivity levels, obviating the need for multiple models and a costly training procedure. We evaluate our method on the large-scale SBU and UCF shadow datasets, and observe up to 17 error reduction with respect to the previous state-of-the-art method.