Smart Device Profiling for Smart SCADA

SCADA (Supervisory Control and Data Acquisition) systems are computer systems used for monitoring and controlling industrial processes such as power plants and power grid systems, water, gas and oil distribution systems, production systems for food, cars and other products. We propose a new approach for regulating and detecting malicious behaviour of network devices in SCADA systems. Our approach consists of building profiles that describe normal communication between pairs of devices in the network. Each profile describes four aspects of network communication: device fingerprint, connectivity pattern, pseudo-protocol pattern and packet content. We validate our approach using network traffic from two real-life SCADA