Intrusion detection for SCADA and BMS.

Abstract

Supervisory Control and Data Acquisition systems (SCADA) are widely used for the control and automation of various types of processes and operations in the industrial field. Lately, the security of these systems has become an issue due to the discovery of vulnerabilities in programmable logical controllers (PLCs) that are the main part of these systems. Regular intrusion detection and prevention systems that are dedicated to detect and-or prevent attacks over different network protocols fail to detect control specific attacks targeted at SCADA networks. We studied the protocols used in SCADA systems and developed an effective detection technique against different types of known and unknown attacks by means of a probabilistic mathematical system. Our system depends basically on the idea of Markov chain to detect any unusual sequence that leads to unacceptable system state. Our design led to detection rates higher than 99percent in most of the experiments in addition to low false negative rates (3.55percent and lower). Moreover, we minimized the training phase of the detection engine by choosing features relevant to SCADA systems.