Traffic-Locality-Based Creation of Flow Whitelists for SCADA Networks - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2015

Traffic-Locality-Based Creation of Flow Whitelists for SCADA Networks

Résumé

The security of supervisory control and data acquisition (SCADA) networks has attracted considerable attention since the discovery of Stuxnet in 2010. Meanwhile, SCADA networks have become increasingly interconnected both locally and remotely. It is, therefore, necessary to develop effective network intrusion detection capabilities. Whitelist-based intrusion detection has become an attractive approach for SCADA networks. However, when analyzing network traffic in SCADA systems, general properties such as TCP handshaking and common ports are insufficient to create flow whitelists. To address the problem, this chapter proposes a methodology for locality-based creation of flow whitelists and conducts experiments to evaluate its effectiveness in seven SCADA systems. The experimental results demonstrate that the methodology generates effective whitelists for deployment in SCADA networks.
Fichier principal
Vignette du fichier
978-3-319-26567-4_6_Chapter.pdf (1.89 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01431015 , version 1 (10-01-2017)

Licence

Paternité

Identifiants

Citer

Seungoh Choi, Yeop Chang, Jeong-Han Yun, Woonyon Kim. Traffic-Locality-Based Creation of Flow Whitelists for SCADA Networks. 9th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2015, Arlington, VA, United States. pp.87-102, ⟨10.1007/978-3-319-26567-4_6⟩. ⟨hal-01431015⟩
49 Consultations
127 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More