scholarly journals Exploiting Bro for Intrusion Detection in a SCADA System

Author(s):  
Robert Udd ◽  
Mikael Asplund ◽  
Simin Nadjm-Tehrani ◽  
Mehrdad Kazemtabrizi ◽  
Mathias Ekstedt
2020 ◽  
pp. 107677
Author(s):  
Chuan Sheng ◽  
Yu Yao ◽  
Qiang Fu ◽  
Wei Yang

2021 ◽  
pp. 210-216
Author(s):  
Mustafa Altaha ◽  
◽  
Jae-Myeong Lee ◽  
Muhammad Aslam ◽  
Sugwon Hong

The intrusion detection system (IDS) is the main tool to do security monitoring that is one of the security strategies for the supervisory control and data acquisition (SCADA) system. In this paper, we develop an IDS based on the autoencoder deep learning model (AE-IDS) for the SCADA system. The target SCADA communication protocol of the detection model is the Distributed Network Protocol 3 (DNP3), which is currently the most commonly utilized communication protocol in the power substation. Cyberattacks that we consider are data injection or modification attacks, which are the most critical attacks in the SCADA systems. In this paper, we extracted 17 data features from DNP3 communication, and use them to train the autoencoder network. We measure accuracy and loss of detection and compare them with different supervised deep learning algorithms. The unsupervised AE-IDS model shows better performance than the other deep learning IDS models.


IEEE Access ◽  
2020 ◽  
Vol 8 ◽  
pp. 147471-147481 ◽  
Author(s):  
Junlei Qian ◽  
Xueqiang Du ◽  
Bo Chen ◽  
Bin Qu ◽  
Kai Zeng ◽  
...  

2019 ◽  
Vol 2019 ◽  
pp. 1-12 ◽  
Author(s):  
R. B. Benisha ◽  
S. Raja Ratna

Intrusion detection and prevention system detects malicious activities that occur in the real-time SCADA systems. This system has a problem without a profound solution. The challenge of the existing intrusion detection is accuracy in the process of detecting the anomalies. In SCADA, wind turbine data are modified by the intruders and forged details are given to the server. To overcome this, the biased intrusion detection system is used for detecting the intrusion with encrypted date, time, and file location with less false-positive and false-negative rates and thereby preventing the SCADA system from further intrusion. It is done in three phases. First, Modified Grey Wolf Optimization (MGWO) is used to extract the features needed for classification and to find the best weight. Second, Entropy-based Extreme Learning Machine (EELM) is used to extort the features and detect the intruded data with its intruded time, file location, and date. Finally, the data are encrypted using the Hybrid Elliptical Curve Cryptography (HECC) to prevent further attack. Experimental results show better accuracy in both detection as well as prevention.


Sign in / Sign up

Export Citation Format

Share Document