Article ID | Journal | Published Year | Pages | File Type |
---|---|---|---|---|
6747696 | International Journal of Critical Infrastructure Protection | 2015 | 33 Pages |
Abstract
This paper describes a novel domain-aware anomaly detection system that detects irregular changes in Modbus/TCP SCADA control register values. The research discovered the presence of three classes of registers: (i) sensor registers; (ii) counter registers; and (iii) constant registers. An automatic classifier was developed to identify these classes. Additionally, parameterized behavior models were created for each class. During its learning phase, the anomaly detection system used the classifier to identify the different types of registers and instantiated the model for each register based on its type. During the enforcement phase, the system detected deviations from the model. The anomaly detection system was evaluated using 131Â h of traffic from a production SCADA system. The classifier had a true positive classification rate of 93%. During the enforcement phase, a 0.86% false alarm rate was obtained for the correctly-classified registers.
Related Topics
Physical Sciences and Engineering
Computer Science
Computer Networks and Communications
Authors
Noam Erez, Avishai Wool,