A Case Study in Power Substation Network Dynamics
A Case Study in Power Substation Network Dynamics
复制标题
变电站网络动力学案例研究
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
R. Beyah
中科院分区：
文献类型：
--
作者：
David Formby;A. Elwalid;R. Beyah
现代世界越来越依赖计算和通信技术来发挥作用，但不幸的是，其在关键基础设施和工业控制系统（ICS）网络等领域的应用和影响仍有待深入研究。已经进行了大量的研究来解决这些领域中的无数安全问题，但它们几乎都是基于人工测试床或模拟，这些测试床或模拟是根据传统IT网络知识或ICS操作的基本原理对其行为进行假设而设计的。在这项工作中，我们提供了最详细的表征的一个例子ICS的日期，以确定这些共同的假设是否成立。在两年半的时间内观察一个带电的配电变电站，以测量其随时间的行为和演变。然后，进行了横向研究，比较这种行为与其他三个变电站从同一公司。虽然大多数预测被发现是正确的，但观察到一些意想不到的行为，突出了ICS和IT网络之间的根本差异，包括由处理速度而不是网络延迟主导的往返时间，几个众所周知的TCP功能在很大程度上是不相关的，以及运行实时操作系统的设备令人惊讶的大抖动。这些意见的影响进行了讨论的一般性，以其他嵌入式网络，网络安全应用程序，并适用于这种环境的TCP协议。
The modern world is becoming increasingly dependent on computing and communication technology to function, but unfortunately its application and impact on areas such as critical infrastructure and industrial control system (ICS) networks remains to be thoroughly studied. Significant research has been conducted to address the myriad security concerns in these areas, but they are virtually all based on artificial testbeds or simulations designed on assumptions about their behavior either from knowledge of traditional IT networking or from basic principles of ICS operation. In this work, we provide the most detailed characterization of an example ICS to date in order to determine if these common assumptions hold true. A live power distribution substation is observed over the course of two and a half years to measure its behavior and evolution over time. Then, a horizontal study is conducted that compared this behavior with three other substations from the same company. Although most predictions were found to be correct, some unexpected behavior was observed that highlights the fundamental differences between ICS and IT networks including round trip times dominated by processing speed as opposed to network delay, several well known TCP features being largely irrelevant, and surprisingly large jitter from devices running real-time operating systems. The impact of these observations is discussed in terms of generality to other embedded networks, network security applications, and the suitability of the TCP protocol for this environment.