We present the first technique of passive fingerprinting for Supervisory Control And Data Acquisition (SCADA) networks without Deep Packet Inspection (DPI) and experience on real environment. Unlike existing work, our method does not rely on the functions of a specific product or DPI of the SCADA protocol. Our inference method, which is based on the intrinsic characteristics of SCADA, first identifies the network port used for the SCADA protocol, then consecutively infers the field devices and master server. We evaluated the effectiveness of our method using two network traces collected from a real environment for a month and a half, three days from different CI respectively. This confirmed the ability of our method to capture most of the SCADA with high F-score nearly 1, except for HMIs connected to master server, and demonstrated the practical applicability of the method.
The other applicable existing work is protocol reverse engineering that the process of the inferring the specification of an unknown network protocol @cite_7 . These techniques leverage approach for automatically extracting information of unknown target protocol. Even though they contribute to analysis of unknown network environment and helpful to provide major SCADA protocols, it is difficult to cover for analysis of all our CIs in the field. The main difficulty of this problem is closed SCADA information that cannot be provided in public. These techniques based on assumption that we require enough samples from target environment or classification from other distinct types of protocols. Understandably, our CI network information is not public and some major vendors do not public their SCADA protocol specification and information. Even though, these techniques help to analysis several famous SCADA protocol, but this approach is extremely expensive cost to cover all of environment. As SCADA market grows, our CI environment becomes heterogeneous for SCADA device and network protocol. Considering the possibility that customized protocol from standard also can make different result from identified signatures, our method can be applied complementary for analysis of CI that cannot be covered by protocol reversing efforts.
@cite_7
2586860586
Supervisory Control and Data Acquisition (SCADA) systems monitor and control critical infrastructure such as the smart grid. As SCADA systems become increasingly interconnected and adopt more and more cyber-enabled components, the risks of cyber attacks become a major concern. Due to their decentralized organization, peer-to-peer (P2P) botnets are resilient to many existing takedown measures and can be exploited as an effective way to launch cyber attacks on SCADA systems. However, little work has been done to detect P2P botnets in SCADA systems, which carry traffic flows with characteristics significantly different from the Internet. In this paper, we design a P2P-botnet detection method for SCADA systems, leveraging built-in traffic monitoring capabilities of SCADA networking devices. The proposed method consists of two stages. In the first stage, we design a simple feature test to filter out non-P2P hosts, which significantly reduces the data volume for P2P-botnet identification. In the second stage, we jointly consider flow-based and connectivity-based features that effectively set apart bots from benign hosts. We propose to use unsupervised learning for P2P-botnet identification, which not only identifies known P2P botnets but also captures newly emerged ones. Our simulation results show that the proposed system achieves high detection rates with very few false positives. Furthermore, our evaluation shows that the proposed method can detect hosts running P2P SCADA applications that are infected by P2P bots.