Understanding IEC-60870-5-104 Traffic Patterns in SCADA Networks
Understanding IEC-60870-5-104 Traffic Patterns in SCADA Networks
复制标题
了解 SCADA 网络中的 IEC-60870-5-104 流量模式
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
S. Nadjm
中科院分区：
文献类型：
--
作者：
Chih;S. Nadjm
IEC-60870-5-104（IEC-104）协议通常用于监控和数据采集（SCADA）网络，以操作关键基础设施，如发电站。随着SCADA安全性的重要性日益增长，已经研究了基于SCADA系统中使用的轮询机制的规律性来开发防御机制的SCADA流量的表征和建模，而尚未研究由非轮询机制（诸如自发事件）引起的流量的表征。本文首先介绍了SCADA组件之间的流量如何随时间变化。提出了一种基于概率后缀树（PST）的方法来发现自发事件的潜在时间模式。在14个测试的数据序列中，有11个数据序列中，我们看到了潜在模式存在的证据。接下来，研究了该方法的预测能力，这对于设计异常检测机制是有用的。虽然一些数据模式可以实现80%的预测可能性，但需要更多的工作来调整该方法以获得更高的准确性。
The IEC-60870-5-104 (IEC-104) protocol is commonly used in Supervisory Control and Data Acquisition (SCADA) networks to operate critical infrastructures, such as power stations. As the importance of SCADA security is growing, characterization and modeling of SCADA traffic for developing defense mechanisms based on the regularity of the polling mechanism used in SCADA systems has been studied, whereas the characterization of traffic caused by non-polling mechanisms, such as spontaneous events, has not yet been studied. This paper provides a first look at how the traffic flowing between SCADA components changes over time. It proposes a method built upon Probabilistic Suffix Tree (PST) to discover the underlying timing patterns of spontaneous events. In 11 out of 14 tested data sequences, we see evidence of existence of underlying patterns. Next, the prediction capability of the approach, useful for devising anomaly detection mechanisms, was studied. While some data patterns enable an 80% prediction possibility, more work is needed to tune the method for higher accuracy.