Supervisory Command and Data Acquisition (SCADA) system cyber security analysis using a live, virtual, and constructive (LVC) testbed
Abstract
Modern critical infrastructure systems are built on a hodgepodge of complex, interconnected information systems for control and management. For electric power, the critical infrastructure includes the physical systems; comprised of power generation, transmission and distribution capabilities. The control of the physical systems is accomplished via Supervisory Command and Data Acquisition (SCADA) systems. The SCADA systems employ both new and legacy systems along with many of the same information system devices as traditional business information systems. SCADA system networks, just as business information system networks, are connected to external networks, including the Internet. Thus, SCADA systems are vulnerable to the same classes of threats as other networked computer systems in addition to threats associated with their legacy systems. Many of these systems have been put in place for decades and often have an unknown security posture. Cyber security analysis of these systems remains a significant challenge. Traditional techniques such as red-teaming, vulnerability assessments, and penetration testing are often unsatisfactory and limited in scope because power utilities do not want to risk taking the systems off-line or degrading or damaging the expensive equipment. The consequence is that the effects of a cyber-attack on these SCADA systems are often unknown. In order to provide greater SCADA system security posture insight to utilities and administrators, security experts must perform security analysis. To overcome the problems with security analysis using either an exclusive hardware SCADA testbed or a simulation of a SCADA system, Sandia National Labs has developed a cyber-security analysis capability using physical hardware, extensive virtualization and emulated machines, and simulation to answer complex system questions about SCADA systems. In this paper we will discuss the methodology, several use-cases that were executed during the course of the study which leverage the methodology, the types of cyber-attacks that can be assessed and the class of questions security professionals can now ask and answer about cyber-attacks against SCADA systems.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Malicious users understand signature-based technologies and can craft malware that can elude such systems and remain undetected.
“Malicious users understand signature-based technologies and can craft malware that can elude such systems and remain undetected, as described by Winn et al. [107].”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [107]
Honeypot should mimic a device (such as PLC) as part of a larger system to be of interest to the attackers.
“Honeypot should mimic a device (such as PLC) as part of a larger system to be of interest to the attackers as described by Winn et al. [107].”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [107]
Honey pots provide knowledge about the tactics and techniques employed by malicious users and also about the origin of such attack.
“They provide knowledge about the tactics and techniques employed by the malicious users [107] and also about the origin of such attack.”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [107]
Cites
Application of trusted network technology to industrial control networks
Okhravi, H., & Nicol, D. M. (2009) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2009.07.001 · Cited by 25 · see citing works
Simulated, Emulated, and Physical Investigative Analysis (SEPIA) of networked systems
Leeuwen, B. P. V., Burton, D., Onunkwo, U., & McDonald, M. J. (2009) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom.2009.5380118 · Cited by 9 · see citing works
BGP Analysis using System-in-the-Loop (SITL) Testbed.
Leeuwen, B. P. V., Onunkwo, U., & McDonald, M. J. (2008) · OSTI OAI (U.S. Department of Energy Office of Scientific and Technical Information) · Cited by 6 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Cyber-Physical Systems Security—A Survey
Humayed, A., Lin, J., Li, F., & Luo, B. (2017) · IEEE Internet of Things Journal · doi:10.1109/jiot.2017.2703172 · Cited by 1,185 · see citing works
Cyber ranges and security testbeds: Scenarios, functions, tools and architecture
Yamin, M. M., Katt, B., & Gkioulos, V. (2019) · Computers & Security · doi:10.1016/j.cose.2019.101636 · Cited by 273 · see citing works
A Survey on Industrial Control System Testbeds and Datasets for Security Research
Conti, M., Donadel, D., & Turrin, F. (2021) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2021.3094360 · Cited by 284 · see citing works
Assessing and augmenting SCADA cyber security: A survey of techniques
Nazir, S., Patel, S., & Patel, D. (2017) · Computers & Security · doi:10.1016/j.cose.2017.06.010 · Cited by 167 · see citing works
“Analysis methods and tools are very important to secure such systems [29].”
BackgroundMethodInfluentialNader, P., Honeine, P., & Beauseroy, P. (2014) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2014.2330796 · Cited by 122 · see citing works
A Survey of Industrial Control System Testbeds
Holm, H., Karresand, M., Vidström, A., & Westring, E. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-26502-5_2 · Cited by 104 · see citing works
Smadi, A. A., Ajao, B., Johnson, B. K., Lei, H., Chakhchoukh, Y., & Al-Haija, Q. S. A. (2021) · Electronics · doi:10.3390/electronics10091043 · Cited by 84 · see citing works
The Design of ICS Testbed Based on Emulation, Physical, and Simulation (EPS-ICS Testbed)
Gao, H., Peng, Y., Jia, K., Dai, Z., & Wang, T. (2013) · International Conference on Intelligent Information Hiding and Multimedia Signal Processing (IIH-MSP) · doi:10.1109/iih-msp.2013.111 · Cited by 38 · see citing works
Cyber Security Risk Assessment on Industry 4.0 using ICS testbed with AI and Cloud
Matsuda, W., Fujimoto, M., Aoyama, T., & Mitsunaga, T. (2019) · IEEE Conference on Application, Information and Network Security (AINS) · doi:10.1109/ains47559.2019.8968698 · Cited by 35 · see citing works
Ani, U., Watson, J., Green, B., Craggs, B., & Nurse, J. R. C. (2020) · Journal of Cyber Security Technology · doi:10.1080/23742917.2020.1843822 · Cited by 34 · see citing works
Application Perspective on Cybersecurity Testbed for Industrial Control Systems
Pospíšil, O., Blažek, P., Kuchař, K., Fujdiak, R., & Mišurec, J. (2021) · Sensors · doi:10.3390/s21238119 · Cited by 30 · see citing works
Operational cost of deploying Moving Target Defenses defensive work factors
Leeuwen, B. P. V., Stout, W. M. S., & Urias, V. E. (2015) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom.2015.7357570 · Cited by 27 · see citing works
Self-citationOn Practical Threat Scenario Testing in an Electric Power ICS Testbed
Siddiqi, A., Tippenhauer, N. O., Mashima, D., & Chen, B. (2018) · ACM Workshop on Cyber-Physical System Security (CPSS) · doi:10.1145/3198458.3198461 · Cited by 27 · see citing works
Gathering threat intelligence through computer network deception
Urias, V. E., Stout, W. M. S., & Han, L. (2016) · IEEE Conference on Technologies for Homeland Security (HST) · doi:10.1109/ths.2016.7568916 · Cited by 22 · see citing works
Self-citationReal-Time and Interactive Attacks on DNP3 Critical Infrastructure Using Scapy
Rodofile, N. R., Radke, K., & Foo, E. (2015) · QUT ePrints (Queensland University of Technology) · Cited by 21 · see citing works
Development of cyber security testbed for critical infrastructure
Jarmakiewicz, J., Maślanka, K., & Parobczak, K. (2015) · International Conference on Military Communications and Information Systems (ICMCIS) · doi:10.1109/icmcis.2015.7158687 · Cited by 18 · see citing works
An ensemble learning for anomaly identification in SCADA system
Siddavatam, I. N. A., Satish, S., Mahesh, W., & Kazi, F. (2017) · International Conference on Power Systems (ICPS) · doi:10.1109/icpes.2017.8387337 · Cited by 14 · see citing works
Experience and Lessons in Building an ICS Security Testbed
Tao, Y., Xu, W., Li, H., & Ji, S. (2019) · International Conference on Industrial Artificial Intelligence (IAI) · doi:10.1109/iciai.2019.8850804 · Cited by 12 · see citing works
Behavioural Observation for Critical Infrastructure Security Support
Hurst, W., Merabti, M., & Fergus, P. (2013) · UKSim European Symposium on Computer Modeling and Simulation (EMS) · doi:10.1109/ems.2013.6 · Cited by 10 · see citing works
Smart Grids Transmission Network Testbed: Design, Deployment, and Beyond
Blažek, P., Bohačík, A., Fujdiak, R., Jurák, V., & Ptáček, M. (2025) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3517340 · Cited by 9 · see citing works
Bilgi Toplumuna Geçiş Ve Siber Güvenlik
Yılmaz, E. N., Halil İbrahim, U. L. U. S., & Gönen, S. (2015) · Bilişim Teknolojileri Dergisi · doi:10.17671/btd.87028 · Cited by 9 · see citing works
Lee, D., Kim, D., Ahn, M. K., Jang, W., & Lee, W. (2021) · IEEE Access · doi:10.1109/access.2021.3051072 · Cited by 9 · see citing works
Emulytics? at Sandia National Laboratories.
Wright, B. J., Urias, V. E., Leeuwen, B. P. V., & Stout, W. M. S. (2015) · OSTI OAI (U.S. Department of Energy Office of Scientific and Technical Information) · Cited by 8 · see citing works
Self-citationCyber Security Risks of Technical Components in Industry 4.0
Matsuda, W., Fujimoto, M., Hashimoto, Y., & Mitsunaga, T. (2021) · IEEE International Conference on Omni-layer Intelligent Systems (COINS) · doi:10.1109/coins51742.2021.9524088 · Cited by 7 · see citing works
The application of applied category theory to quantify mission success
Garrett, R. K., Fairbanks, J., Loper, M. L., & Moreland, J. D. (2022) · SIMULATION · doi:10.1177/00375497221114861 · Cited by 5 · see citing works
Empirical assessment of network-based Moving Target Defense approaches
Leeuwen, B. P. V., Stout, W. M. S., & Urias, V. E. (2016) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom.2016.7795421 · Cited by 5 · see citing works
Self-citationAn Anomaly Detection Technique for Deception Attacks in Industrial Control Systems
Qassim, Q. S., Ahmad, A. R., Ismail, R., Bakar, A. A., Rahim, F. A., Mokhtar, M. Z., Ramli, R., Yusof, B., & Mahdi, M. N. (2019) · IEEE International Conference on Big Data Security on Cloud, IEEE International Conference on High Performance and Smart Computing, and IEEE International Conference on Intelligent Data and Security (BigDataSecurity/HPSC/IDS) · doi:10.1109/bigdatasecurity-hpsc-ids.2019.00057 · Cited by 5 · see citing works
Exploiting Control Device Vulnerabilities: Attacking Cyber-Physical Water System
Sindhwad, P. V., & Kazi, F. (2022) · Conference of Open Innovations Association (FRUCT) · doi:10.23919/fruct56874.2022.9953826 · Cited by 5 · see citing works
Implementation of SCADA for multiple telemetry units while using GSM for communication
Ulain, Q., Shah, M., Khan, M., & Mahmud, S. A. (2015) · International Conference on Emerging Technologies · doi:10.1109/icet.2015.7389224 · Cited by 5 · see citing works
Impacts of bad data injection on power systems security: Intruder point of view
Gharebaghi, S., Hosseini, S. H., Izadi, M., & Safdarian, A. (2017) · Smart Grid Conference · doi:10.1109/sgc.2017.8308860 · Cited by 4 · see citing works
Post-exploitation and Persistence Techniques Against Programmable Logic Controller
Bytes, A., & Zhou, J. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-61638-0_15 · Cited by 4 · see citing works
Experimental Methods for Control System Security Research
Urias, V. E., & Leeuwen, B. P. V. (2016) · Advances in information security · doi:10.1007/978-3-319-32125-7_13 · Cited by 3 · see citing works
Self-citationConsequence Verification During Risk Assessments of Smart Grids
Abraham, D., Toftegaard, O. A. A., Gebremedhin, A., & Yayilgan, S. Y. (2023) · IFIP advances in information and communication technology · doi:10.1007/978-3-031-49585-4_3 · Cited by 2 · see citing works
Lessons Learned for Practical penetration test against Industrial Control Systems
Fujimoto, M., Itani, Y., & Mitsunaga, T. (2023) · IEEE International Conference on Computing (ICOCO) · doi:10.1109/icoco59262.2023.10397899 · Cited by 2 · see citing works
Arnold, D., Ford, J. M. T., & Saniie, J. (2025) · Information · doi:10.3390/info16070604 · Cited by 2 · see citing works
Leveraging a LiveNirtual/Constructive Testbed for the Evaluation of Moving Target Defenses
Stout, W. M. S., Leeuwen, B. P. V., Urias, V. E., Tuminaro, J., Schrock, S., & Dossaji, N. (2018) · IEEE International Carnahan Conference on Security Technology (ICCST) · doi:10.1109/ccst.2018.8585478 · Cited by 2 · see citing works
Self-citationMeasuring The Cyber Security Risk Assessment Methods For Scada System
Hossain, N. (2017) · Zenodo (CERN European Organization for Nuclear Research) · doi:10.5281/zenodo.824954 · Cited by 2 · see citing works
Ibrahim, A. Z. M., Yahaya, J. H., & Deraman, A. (2018) · Jurnal Pengurusan · doi:10.17576/pengurusan-2018-53-15 · Cited by 2 · see citing works
Ani, U., Watson, J., Green, B., Craggs, B., & Nurse, J. R. C. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.01471 · Cited by 2 · see citing works
Design and development of wireless RTU and cybersecurity framework for SCADA system
Durrani, S., Jattala, I., Farooqi, J., Shakeel, N., & Murad, M. (2013) · International Conference on Information and Communication Technologies · doi:10.1109/icict.2013.6732781 · Cited by 1 · see citing works
The Role of One-Class Classification in Detecting Cyberattacks in Critical Infrastructures
Nader, P., Honeiné, P., & Beauseroy, P. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-31664-2_25 · Cited by 1 · see citing works
Zegeye, W. K., Dean, R., Dugda, M. T., Moazzami, F., & Bezabih, A. (2021) · Computers · doi:10.3390/computers10040045 · Cited by 1 · see citing works
Retracted Chapter: Cyber-Physical System Security Controls: A Review
Majumder, S., Mathur, A., & Javaid, A. Y. (2018) · EAI/Springer Innovations in Communication and Computing · doi:10.1007/978-3-319-92564-6_8 · Cited by 1 · see citing works
RetractedA Security Assessment Model for Electrical Power Grid SCADA System
(2019) · International Journal of Innovative Technology and Exploring Engineering · doi:10.35940/ijitee.l1132.10812s219 · Cited by 1 · see citing works
Precise Risk Assessment and Management
Ambika, N. (2022) · doi:10.1002/9781119836636.ch4 · Cited by 1 · see citing works
Testbed for Cellular Telecommunications Cyber Vulnerability Analysis
Leeuwen, B. P. V., Urias, V. E., Glatter, C., & Interrante-Grant, A. (2013) · IEEE Military Communications Conference (MILCOM) · doi:10.1109/milcom.2013.236
Self-citationMicro-CI: A Critical Systems Testbed for Cyber-Security Research
Hurst, W., Shone, N., Shi, Q., & Bazli, B. (2016)
Detecting Network Attack Vectors On SCADA Specific Network Operating On Modbus TCP/IP Protocol
Pathak, N. H., & Patel, N. H. B. (2014)
Leps, O. (2018) · Springer eBooks · doi:10.1007/978-3-658-22614-5_4
Modellierung und Implementierung hybrider Testumgebungen für cyber-physische Sicherheitsanalysen
Leps, O. (2018) · Springer eBooks · doi:10.1007/978-3-658-22614-5_5
Leps, O. (2018) · Springer eBooks · doi:10.1007/978-3-658-22614-5_6
Virtualizing Industrial Control Networks for Cyber Resilience Experiments
Johnson, J. A., USDOE, Hanson, A., Hahn, D., Guerra, J., Werth, A. W., & Herron, A. (2023) · doi:10.2172/2217000
Odonkor, P., & Honu, E. (2025) · IEEE Access · doi:10.1109/access.2025.3582743
Tong, F., Yu, F., Xu, L., & Zhao, D. (2025) · International Conference on Blockchain Technology and Information Security (ICBCTIS) · doi:10.1109/icbctis66509.2025.11387615
- Authors
- Urias, V., Van Leeuwen, B., & Richardson, B.
- Affiliations
- Sandia National Laboratories (US)
- Venue
- MILCOM 2012 - 2012 IEEE Military Communications Conference
- Publisher
- IEEE
- Published
- 2012-10
- Pages
- 1-8
- OpenAlex
- W2059966511
- Cited by
- 56
- References
- 3
- Citations by year
- 2025: 4 · 2023: 3 · 2022: 3 · 2021: 6 · 2020: 2 · 2019: 6 · 2018: 7 · 2017: 5 · 2016: 6 · 2015: 8 · 2014: 2 · 2013: 4
- FWCI
- 7.18
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- IEEE Military Communications Conference (MILCOM) (publishedVersion)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- SCADA systems, critical infrastructure security, power systems, legacy systems, virtualization, emulation, security posture
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
