Increasing Visibility of IEC 104 Communication in the Smart Grid

Energy systems like smart grids are part of critical infrastructure and their interruption or blackout may have fatal consequences on energy production, distribution, and eventually the life of individual people. In order to secure communication in Industrial Control Systems (ICS) and detect cyber attacks on smart grids, we need to increase visibility of ICS communication so that an operator can see what commands are sent between ICS devices. Security monitoring of ICS transmission requires (i) retrieving monitoring data from ICS packets, (ii) processing and analyzing extracted data, (iii) visualizing the ongoing communication to the operator. The proposed work presents a concept of ICS flow monitoring system that extracts meta data from ICS packet headers and creates ICS flow records similarly to Netflow/IPFIX system. ICS flows represent communication in the smart grid network that is further visualized using dashboard and communication charts. Unlike traditional monitoring approach that works with network and transport layer data only, we extend flow monitoring to application layer with focus on ICS protocols. The proposed approach is demonstrated on monitoring IEC 60870-5-104 communication.

Content

Author and article information

Contributors

Petr Matoušek

Ondřej Ryšavý

Matěj Grégr

Conference

Publication date: September 2019

Publication date (Print): September 2019

Pages: 21-30

Affiliations

[0001]Brno University of Technology

Božetěchova 1/2

Brno, Czech Republic

Article

DOI: 10.14236/ewic/icscsr19.3

SO-VID: 0ba50e72-98fe-4bbf-b683-6107a28c4df4

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: 6th International Symposium for ICS & SCADA Cyber Security Research 2019

Conference acronym: ICS-CSR

Conference number: 6

Conference location: Athens, Greece

Conference date: 10th-12th September 2019

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: Cyber Security Research

History

Product

1477-9358 BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/icscsr19.3

Self URI (journal page): https://ewic.bcs.org/

REFERENCES

M. J. AssanteR. M. Lee 2015 October The Industrial Control System Cyber Kill Chain Technical report, SANS Institute
M. J. AssanteR. M. LeeT. Conway 2017 August Modular ICS Malware. Technical report Electricity Information Sharing and Analysis Center (E-ISAC)
A. Cherepanov 2017 June Win32/Industroyer. A new threat for industrial control systems. Technical report ESET
B. Claise 2004 October Cisco Systems NetFlow Services Export Version 9. IETF RFC 3954
B. ClaiseB. Trammel 2013 September Information Model for IP Flow Information Export (IPFIX). IETF RFC 7012
B. ClaiseB. TrammelP. Aitken 2013 September Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information. IETF RFC 7011
Dragos 2017 June CrashOverride. Analysis of the Threat of Electric Grid Operations. Technical report Dragos Inc
ENISA 2016 December Communication network dependencies for ICS/SCADA Systems. Technical report European Union Agency for Network and Information Security (ENISA)
R. Gerhards 2009 March The Syslog Protocol IETF RFC 5424
M. Horkan 2015 July Challenges for IDS/IPS Deployment in Industrial Control Systems. Technical report SANS Institute
IEC 2006 June Telecontrol equipment and systems - Part 5-104: Transmission protocols - Network access for IEC 60870-5-101 using standard transport profiles. Standard IEC 60870-5-104:2006 International Electrotechnical Commission Geneva
J. JarmakiewiczK. ParobczakK. Maślanka 2017 Cybersecurity protection for power grid control infrastructures International Journal of Critical Infrastructure Protection 18 20 33
E. D. KnappJ. T. Langill 2015 Industrial Network Security. Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems. Syngress
R. M. LeeM. J. AssanteT. Conway 2016 March Analysis of the Cyber Attack on the Ukrainian Power Grid. Defense Use Case. Technical report Electricity Information Sharing and Analysis Center (E-ISAC)
C.-Y. LinS. Nadjm-Tehrani 2018 Understanding IEC-60870-5-104 Traffic Patterns in SCADA Networks Proceedings of the 4th ACM Workshop on Cyber-Physical System Security CPSS ’18 New York, NY, USA 51 60 ACM
Z. LuX. LuW. WangC. Wang 2010 Oct Review and evaluation of security threats on the communication networks in the smart grid 2010 - MILCOM 2010 MILITARY COMMUNICATIONS CONFERENCE, 1830 1835
P. Matoušek 2017 Description and analysis of IEC 104 Protocol. Technical Report FIT-TR-2017-12 Brno University of Technology
P. MaynardK. McLaughlinB. Haberler 2014 Towards Understanding Man-In-The-Middle Attacks on IEC 60870-5-104 SCADA Networks Proceedings of the 2Nd International Symposium on ICS & SCADA Cyber Security Research 2014 ICS-CSR 2014 UK 30 42 BCS
B. MillerD. C. Rowe 2012 A survey of SCADA and critical infrastructure incidents In Proceedings of the 1st Annual conference on Research in information technology, RIIT ’12 51 56 ACM
R. PresuhnJ. CaseK. McCloghrieM. RoseS. Waldbusser 2002 December Version 2 of the Protocol Operations for the Simple Network Management Protocol (SNMP) Ietf rfc 3416
K. StoufferV. PillitteriM. AbramsA. Hahn 2015 Guide to Industrial Control Systems (ICS) Security. Technical Report NIST-SP-800-82r2 National Institute of Standards and Technology
Y. YangK. McLaughlinT. LittlerS. SezerB. PranggonoH. F. Wang 2013 July Intrusion detection system for iec 60870-5-104 based scada networks 2013 IEEE Power Energy Society General Meeting 1 5

Comments

Comment on this article

[1] M. J. AssanteR. M. Lee 2015 October The Industrial Control System Cyber Kill Chain Technical report, SANS Institute

[2] M. J. AssanteR. M. LeeT. Conway 2017 August Modular ICS Malware. Technical report Electricity Information Sharing and Analysis Center (E-ISAC)

[3] A. Cherepanov 2017 June Win32/Industroyer. A new threat for industrial control systems. Technical report ESET

[4] B. Claise 2004 October Cisco Systems NetFlow Services Export Version 9. IETF RFC 3954

[5] B. ClaiseB. Trammel 2013 September Information Model for IP Flow Information Export (IPFIX). IETF RFC 7012

[6] B. ClaiseB. TrammelP. Aitken 2013 September Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information. IETF RFC 7011

[7] Dragos 2017 June CrashOverride. Analysis of the Threat of Electric Grid Operations. Technical report Dragos Inc

[8] ENISA 2016 December Communication network dependencies for ICS/SCADA Systems. Technical report European Union Agency for Network and Information Security (ENISA)

[9] R. Gerhards 2009 March The Syslog Protocol IETF RFC 5424

[10] M. Horkan 2015 July Challenges for IDS/IPS Deployment in Industrial Control Systems. Technical report SANS Institute

[11] IEC 2006 June Telecontrol equipment and systems - Part 5-104: Transmission protocols - Network access for IEC 60870-5-101 using standard transport profiles. Standard IEC 60870-5-104:2006 International Electrotechnical Commission Geneva

[12] J. JarmakiewiczK. ParobczakK. Maślanka 2017 Cybersecurity protection for power grid control infrastructures International Journal of Critical Infrastructure Protection 18 20 33

[13] E. D. KnappJ. T. Langill 2015 Industrial Network Security. Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems. Syngress

[14] R. M. LeeM. J. AssanteT. Conway 2016 March Analysis of the Cyber Attack on the Ukrainian Power Grid. Defense Use Case. Technical report Electricity Information Sharing and Analysis Center (E-ISAC)

[15] C.-Y. LinS. Nadjm-Tehrani 2018 Understanding IEC-60870-5-104 Traffic Patterns in SCADA Networks Proceedings of the 4th ACM Workshop on Cyber-Physical System Security CPSS ’18 New York, NY, USA 51 60 ACM

[16] Z. LuX. LuW. WangC. Wang 2010 Oct Review and evaluation of security threats on the communication networks in the smart grid 2010 - MILCOM 2010 MILITARY COMMUNICATIONS CONFERENCE, 1830 1835

[17] P. Matoušek 2017 Description and analysis of IEC 104 Protocol. Technical Report FIT-TR-2017-12 Brno University of Technology

[18] P. MaynardK. McLaughlinB. Haberler 2014 Towards Understanding Man-In-The-Middle Attacks on IEC 60870-5-104 SCADA Networks Proceedings of the 2Nd International Symposium on ICS & SCADA Cyber Security Research 2014 ICS-CSR 2014 UK 30 42 BCS

[19] B. MillerD. C. Rowe 2012 A survey of SCADA and critical infrastructure incidents In Proceedings of the 1st Annual conference on Research in information technology, RIIT ’12 51 56 ACM

[20] R. PresuhnJ. CaseK. McCloghrieM. RoseS. Waldbusser 2002 December Version 2 of the Protocol Operations for the Simple Network Management Protocol (SNMP) Ietf rfc 3416

[21] K. StoufferV. PillitteriM. AbramsA. Hahn 2015 Guide to Industrial Control Systems (ICS) Security. Technical Report NIST-SP-800-82r2 National Institute of Standards and Technology

[22] Y. YangK. McLaughlinT. LittlerS. SezerB. PranggonoH. F. Wang 2013 July Intrusion detection system for iec 60870-5-104 based scada networks 2013 IEEE Power Energy Society General Meeting 1 5

Studying business & IT? Drive your professional career forwards with BCS books - for a 20% discount click here: shop.bcs.org