Security Information and Event Management (SIEM) systems work on SCADA systems by observing and reacting to the dynamic security-related events of the target automation system. These events are created by collecting/filtering raw logs maintained by its subcomponents. Preferably, logging items are attached with synchronized timestamps. Specific data of security-related event can be correlated an...

Terrorist groups are currently using information and communication technologies (ICTs) to orchestrate their conventional physical attacks. More recently, terrorists have been developing a new form of capability within the cyber-arena to coordinate cyber-based attacks. This paper identifies that cyber-terrorism capabilities are an integral, imperative, yet under-researched component in establish...

We present the first technique of passive fingerprinting for Supervisory Control And Data Acquisition (SCADA) networks without Deep Packet Inspection (DPI) and experience on real environment. Unlike existing work, our method does not rely on the functions of a specific product or DPI of the SCADA protocol. Our inference method, which is based on the intrinsic characteristics of SCADA, first ide...

Terrorist groups are currently using information and communication technologies (ICTs) to orchestrate their conventional attacks. More recently, terrorists have been developing a new form of capability within the cyber-arena to coordinate cyber-based attacks. This chapter identifies that cyber-terrorism capabilities are an integral, imperative, yet under-researched component in establishing, an...

In this paper we present an intrusion detection module capable of detecting malicious network traffic in a SCADA (Supervisory Control and Data Acquisition) system, based on the combination of One-Class Support Vector Machine (OCSVM) with RBF kernel and recursive k-means clustering. Important parameters of OCSVM, such as Gaussian width σ and parameter ν affect the performance of the classifier. ...

Supervisory Control and Data Acquisition (SCADA) systems are vital components of most nation’s critical infrastructures. SCADA systems are primarily control systems. They control pipelines, water and transportation systems, utilities, refineries, chemical plants, and a wide variety of manufacturing operations. Sensor networks are becoming increasingly important in various applications such as m...

The purpose of this paper is to give an overview of the VIKING project including its motivation and background. The VIKING project has been started to investigate the increased cyber security risks for deliberate attacks on critical infrastructures coming from SCADA systems and to propose mitigation. The second part of this paper describes the principle design of modern SCADA systems in order t...

SCADA infrastructures, which traditionally were isolated from outside systems, have now become highly integrated via internal and external communication paths. These integrations increased efficiency greatly but introduced security vulnerabilities. This paper presents a solution for mitigating those security vulnerabilities by integrating VLAN and VPN technologies. VLAN segmentation provides vi...

Supervisory control and data acquisition (SCADA) systems and distributed control systems (DCS) were innovated to reduce labor costs, and to permit system-wide monitoring and remote control from a headquarter. Control systems are widely implemented in critical infrastructures such as electric grid, natural gas and petroleum, water, and wastewater industries. In this paper the structure and archi...

Data collected from the supervisory control and data acquisition (SCADA) system, used widely in wind farms to obtain operational and condition information about wind turbines (WTs), is of important significance for anomaly detection in wind turbines. The paper presents a novel model for wind turbine anomaly detection mainly based on SCADA data and a back-propagation neural network (BPNN) for au...