BROWSE
Detail
Conference Paper
Detecting Abnormal Behavior in SCADA Networks Using Normal Traffic Pattern Learning
Cited 9 time in 
Share 
Share
- Authors
- Byoung-Koo Kim, Dong-Ho Kang, Jung-Chan Na, Tai-Myoung Chung
- Issue Date
- 2014-12
- Citation
- International Conference on Computer Science and its Applications (CSA) 2014 (LNEE 330), v.330, pp.121-126
- Publisher
- Springer
- Language
- English
- Type
- Conference Paper
- Abstract
- SCADA systems have been upgraded from the standard serial bus systems to modern TCP/IP based systems. The Modbus protocol is one of the most widely used protocols in SCADA networks. However, it provides no inherent security mechanisms. Therefore, the Modbus protocol is susceptible to the type of attack that injects false Modbus commands by fabrication or modification. In this paper, we propose an abnormal behavior detection method by using normal traffic pattern learning on Modbus/TCP transactions. Our approach is based on the characteristics of SCADA networks that are likely to have a regular traffic pattern. Most of all, the proposed method is performed according to the analysis of only Modbus/TCP request messages. Therefore, it has the benefit of detecting abnormal behavior on even with the simple traffic pattern learning.
- KSP Keywords
- Abnormal behavior detection, Detection Method, MODBUS protocol, Normal traffic, Pattern learning, SCADA system, Traffic pattern, based system, bus system, security mechanism, serial bus