Critical State-Based Filtering System for Securing SCADA Network Protocols
Abstract
The security of System Control and Data Acquisition (SCADA) systems is one of the most pressing subjects in industrial systems, particularly for those installations actively using the public network in order to provide new features and services. In this paper, we present an innovative approach to the design of filtering systems based on the state analysis of the system being monitored. The aim is to detect attacks composed of a set of “SCADA” commands that, while licit when considered in isolation on a single-packet basis, can disrupt the correct behavior of the system when executed in particular operating states. The proposed firewall detects these complex attacks thanks to an internal representation of the controlled SCADA system. Furthermore, we detail the design of the architecture of the firewall for systems that use the ModBus and DNP3 protocols, and the implementation of a prototype, providing experimental comparative results that confirm the validity of the proposed approach.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Vulnerability assessment and analysis comprises a spectrum of techniques from port scanning to exploitation of vulnerabilities as in an actual attack.
“Vulnerability assessment and analysis comprises of a spectrum of techniques from the simplest ones doing port scanning to those involving exploitation of vulnerabilities, as in an actual attack [27].”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [27]
SCADA systems differ in characteristics from conventional information technology systems.
“SCADA system (Figure 1) differs in characteristics from a conventional information technology (IT) system [8], [27].”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [27]
Cites
Snort - Lightweight Intrusion Detection for Networks
Roesch, M. (1999) · Cited by 3,094 · see citing works
Process fault detection based on modeling and estimation methods—A survey
Isermann, R. (1984) · Automatica · doi:10.1016/0005-1098(84)90098-0 · Cited by 2,369 · see citing works
Networked Control System: Overview and Research Trends
Gupta, R. A., & Chow, M. (2009) · IEEE Transactions on Industrial Electronics · doi:10.1109/tie.2009.2035462 · Cited by 1,119 · see citing works
Supervision, fault-detection and fault-diagnosis methods — An introduction
Isermann, R. (1997) · Control Engineering Practice · doi:10.1016/s0967-0661(97)00046-4 · Cited by 962 · see citing works
Alert correlation in a cooperative intrusion detection framework
Cuppens, F., & Miège, A. (2005) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/secpri.2002.1004372 · Cited by 697 · see citing works
Global Intrusion Detection in the DOMINO Overlay System.
Yegneswaran, V., Barford, P., & Jha, S. (2004) · Cited by 289 · see citing works
Natori, K., & Ohnishi, K. (2008) · IEEE Transactions on Industrial Electronics · doi:10.1109/tie.2008.918635 · Cited by 198 · see citing works
Security in Building Automation Systems
Granzer, W., Praus, F., & Kästner, W. (2009) · IEEE Transactions on Industrial Electronics · doi:10.1109/tie.2009.2036033 · Cited by 137 · see citing works
Control Over Imperfect Networks: Model-Based Predictive Networked Control Systems
Onat, A., Naskalı, A. T., Parlakay, E. M., et al. (2010) · IEEE Transactions on Industrial Electronics · doi:10.1109/tie.2010.2051932 · Cited by 133 · see citing works
Security Strategies for SCADA Networks
Chandia, R., Gonzalez, J., Kilpatrick, T., Papa, M., & Shenoi, S. (2007) · Springer eBooks · doi:10.1007/978-0-387-75462-8_9 · Cited by 87 · see citing works
Industrial Cybersecurity for Power System and Scada Networks
Creery, A., & Byres, E. J. (2006) · IEEE IAS Petroleum and Chemical Industry Conference (PCIC) · doi:10.1109/pcicon.2005.1524567 · Cited by 83 · see citing works
Safety- and Security-Critical Services in Building Automation and Control Systems
Novak, T., & Gerstinger, A. (2009) · IEEE Transactions on Industrial Electronics · doi:10.1109/tie.2009.2028364 · Cited by 78 · see citing works
Advanced Fault Detection and Isolation Schemes Using Nonlinear and Robust Observers
Frank, P. M. (1987) · IFAC Proceedings Volumes · doi:10.1016/s1474-6670(17)55353-7 · Cited by 72 · see citing works
Security Protocols Against Cyber Attacks in the Distribution Automation System
Lim, I.-H., Hong, S., Choi, M., et al. (2009) · IEEE Transactions on Power Delivery · doi:10.1109/tpwrd.2009.2021083 · Cited by 64 · see citing works
Industrial cybersecurity for a power system and SCADA networks - Be secure
Creery, A., & Byres, E. J. (2007) · IEEE Industry Applications Magazine · doi:10.1109/mia.2007.4283509 · Cited by 49 · see citing works
Secure "selecticast" for collaborative intrusion detection systems
Gross, P. N. (2004) · doi:10.1049/ic:20040382 · Cited by 48 · see citing works
Effects of intentional threats to power substation control systems
Dondossola, G., Szanto, J., Masera, M., & Fovino, I. N. (2007) · International Journal of Critical Infrastructures · doi:10.1504/ijcis.2008.016096 · Cited by 47 · see citing works
Self-citationData Object Based Security for DNP3 Over TCP/IP for Increased Utility Commercial Aspects Security
Mander, T., Nabhani, F., Wang, L., & Cheung, R. (2007) · IEEE Power Engineering Society General Meeting · doi:10.1109/pes.2007.386243 · Cited by 42 · see citing works
Scada Malware, a Proof of Concept
Carcano, A., Fovino, I. N., Masera, M., & Trombetta, A. (2009) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-03552-4_19 · Cited by 31 · see citing works
Self-citationWide area network performance study of a distribution management system
Su, C., Lu, C., & Lin, M.-J. (2000) · International Journal of Electrical Power & Energy Systems · doi:10.1016/s0142-0615(99)00029-0 · Cited by 23 · see citing works
Emergent Disservices in Interdependent Systems and System-of-Systems
Fovino, I. N., & Masera, M. (2006) · Conference proceedings/Conference proceedings - IEEE International Conference on Systems, Man, and Cybernetics · doi:10.1109/icsmc.2006.384449 · Cited by 21 · see citing works
Self-citationModelling Information Assets for Security Risk Assessment in Industrial Settings
Igor, N. F., & Masera, M. (2006) · Joint Research Centre (European Commission) · Cited by 18 · see citing works
Self-citationA Service Oriented Approach to the Assessment of Infrastructure Security
Igor, N. F., & Masera, M. (2007) · Joint Research Centre (European Commission) · Cited by 11 · see citing works
Self-citationModels for Security Assessment and Management
Igor, N. F., & Masera, M. (2006) · Joint Research Centre (European Commission) · Cited by 10 · see citing works
Self-citationDeveloping a Multi-Layer Strategy for Securing Control Systems of Oil Refineries
Mahmood, M. K., & Al-Naima, F. M. (2010) · Wireless Sensor Network · doi:10.4236/wsn.2010.27064 · Cited by 8 · see citing works
A SCADA system reliability evaluation considering performance requirement
Su, C., & Chang, Y.-C. (2005) · doi:10.1109/icpst.2004.1460060 · Cited by 7 · see citing works
Wide area network performance study of a distribution management system
Su, C., Lu, C., & Lin, M.-J. (1999) · doi:10.1109/tdc.1999.755329 · Cited by 2 · see citing works
Flagged first, then by citations
1 of the 28 references couldn’t be matched to a known paper.
Research works printed but not linked: 2
- quiang, 2009, A communicaton system architecture for regional control of power distribution networks, Proc 7th IEEE Int Conf INDIN, 372
- nai fovino, 2008, ICT security assessment of a power plant, a case study, Proc 2nd Int Conf Critical Infrastructure Protect
Cited by
Sorted by citations
A survey of cyber security management in industrial control systems
Knowles, W., Prince, D., Hutchison, D., Disso, J. F. P., & Jones, K. (2015) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2015.02.002 · Cited by 344 · see citing works
“[135] addressed the challenge of dealing with firewall rule sets for industrial control system protocols by developing a state-based filtering system for the Modbus and DNP3 protocols.”
BackgroundData-Driven Monitoring and Safety Control of Industrial Cyber-Physical Systems: Basics and Beyond
Jiang, Y., Yin, S., & Kaynak, O. (2018) · IEEE Access · doi:10.1109/access.2018.2866403 · Cited by 263 · see citing works
“A major new challenge is that the traditional problems regarding hardware, software and networked systems are correlated [5], [6].”
BackgroundCybersecurity and Privacy Solutions in Smart Cities
Khatoun, R., & Zeadally, S. (2017) · IEEE Communications Magazine · doi:10.1109/mcom.2017.1600297cm · Cited by 185 · see citing works
Assessing and augmenting SCADA cyber security: A survey of techniques
Nazir, S., Patel, S., & Patel, D. (2017) · Computers & Security · doi:10.1016/j.cose.2017.06.010 · Cited by 167 · see citing works
“The inadequacy of rule based approaches with reference to firewalls is elaborated in [67] by stating that for control systems, even a sequence of licit commands can lead the system to an unsafe state.”
BackgroundMethodZhou, C., Huang, S., Xiong, N. N., Yang, S., Li, H., Qin, Y., & Li, X. (2015) · IEEE Transactions on Systems Man and Cybernetics Systems · doi:10.1109/tsmc.2015.2415763 · Cited by 168 · see citing works
“industrial state modeling language (ISML) [8].”
BackgroundMethodInfluentialZhang, Q., Zhou, C., Xiong, N. N., Qin, Y., Li, X., & Huang, S. (2015) · IEEE Transactions on Systems Man and Cybernetics Systems · doi:10.1109/tsmc.2015.2503399 · Cited by 137 · see citing works
Yang, J. Y., Zhou, C., Yang, S., Xu, H., & Hu, B. (2017) · IEEE Transactions on Industrial Electronics · doi:10.1109/tie.2017.2772190 · Cited by 127 · see citing works
Nader, P., Honeine, P., & Beauseroy, P. (2014) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2014.2330796 · Cited by 122 · see citing works
Security Challenges in Control Network Protocols: A Survey
Volkova, A., Niedermeier, M., Basmadjian, R., & de Meer, H. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2872114 · Cited by 118 · see citing works
An unsupervised anomaly-based detection approach for integrity attacks on SCADA systems
Almalawi, A., Yu, X., Tari, Z., Fahad, A., & Khalil, I. (2014) · Computers & Security · doi:10.1016/j.cose.2014.07.005 · Cited by 113 · see citing works
An Efficient Data-Driven Clustering Technique to Detect Attacks in SCADA Systems
Almalawi, A., Fahad, A., Tari, Z., Alamri, A., AlGhamdi, R. A., & Zomaya, A. Y. (2015) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2015.2512522 · Cited by 100 · see citing works
Observer-Based Attack Detection and Mitigation for Cyberphysical Systems: A Review
Kordestani, M., & Saif, M. (2021) · IEEE Systems Man and Cybernetics Magazine · doi:10.1109/msmc.2020.3049092 · Cited by 87 · see citing works
“, in the oil and gas industries), automated vehicles, and medical systems are examples of CPSs [2]–[4].”
BackgroundKey management issue in SCADA networks: A review
Rezai, A., Keshavarzi, P., & Moravej, Z. (2016) · Engineering Science and Technology an International Journal · doi:10.1016/j.jestch.2016.08.011 · Cited by 80 · see citing works
A critical review of cyber-physical security for building automation systems
Li, G., Ren, L., Fu, Y., Yang, Z., Adetola, V., Wen, J., Zhu, Q., Wu, T., Candan, K. S., & O'Neill, Z. (2023) · Annual Reviews in Control · doi:10.1016/j.arcontrol.2023.02.004 · Cited by 71 · see citing works
Ghaeini, H. R., & Tippenhauer, N. O. (2016) · doi:10.1145/2994487.2994492 · Cited by 68 · see citing works
“The authors of [9] proposed a design approach leveraging filtering systems based on state analysis of the system monitored.”
BackgroundA Taxonomy of Supervised Learning for IDSs in SCADA Environments
Suaboot, J., Fahad, A., Tari, Z., Grundy, J., Mahmood, A. N., Almalawi, A., Zomaya, A. Y., & Drira, K. (2020) · ACM Computing Surveys · doi:10.1145/3379499 · Cited by 68 · see citing works
“Using this data, the operational behavior of a given SCADA system can be inferred [24, 41, 99, 126, 136].”
BackgroundMethodA clustering-based approach to detect cyber attacks in process control systems
Kiss, I., Genge, B., & Haller, P. (2015) · 2022 IEEE 20th International Conference on Industrial Informatics (INDIN) · doi:10.1109/indin.2015.7281725 · Cited by 61 · see citing works
SCADAWall: A CPI-enabled firewall model for SCADA security
Li, D., Guo, H., Zhou, J., Zhou, L., & Wong, J. W. (2018) · Computers & Security · doi:10.1016/j.cose.2018.10.002 · Cited by 53 · see citing works
A Stealthy Attack Against Electricity Market Using Independent Component Analysis
Esmalifalak, M., Nguyen, H., Zheng, R., et al. (2015) · IEEE Systems Journal · doi:10.1109/jsyst.2015.2483742 · Cited by 48 · see citing works
“Reference [21] proposes a firewall that detects attacks composed of a set of disruptive supervisory control and data acquisition (SCADA) commands.”
BackgroundA Survey of SCADA Testbed Implementation Approaches
Qassim, Q. S., Jamil, N., Abidin, I. Z., Rusli, M. E., Yussof, S., Ismail, R., Abdullah, F., Ja’affar, N., Hasan, H. C., Daud, M., et al. (2017) · Indian Journal of Science and Technology · doi:10.17485/ijst/2017/v10i26/116775 · Cited by 40 · see citing works
Anomaly Detection in Aging Industrial Internet of Things
Genge, B., Haller, P., & Calin, E. (2019) · IEEE Access · doi:10.1109/access.2019.2920699 · Cited by 40 · see citing works
A new methodology for anomaly detection of attacks in IEC 61850-based substation system
Yang, L., Zhai, Y., Zhang, Y., Zhao, Y., Li, Z., & Xu, T. (2022) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2022.103262 · Cited by 41 · see citing works
Experimental assessment of network design approaches for protecting industrial control systems
Genge, B., Graur, F., & Haller, P. (2015) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2015.07.005 · Cited by 36 · see citing works
Anomaly Detection Methods for IIoT Networks
Zhou, L., & Guo, H. (2018) · IEEE International Conference on Service Operations and Logistics, and Informatics (SOLI) · doi:10.1109/soli.2018.8476769 · Cited by 38 · see citing works
“An anomaly detection method based on a representation of the states of the protected system, and on the prediction of the control commands on the state evolution of an industrial control system was presented in [29].”
MethodLiu, Z., & Wang, L. (2021) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2021.3065504 · Cited by 38 · see citing works
“In [21], a filtering system is proposed based on the critical state analysis to detect the attacks composed of”
BackgroundMethodEscudero, C., Sicard, F., & Zamaï, É. (2018) · IEEE International Conference on Emerging Technologies and Factory Automation (ETFA) · doi:10.1109/etfa.2018.8502585 · Cited by 30 · see citing works
Physical process resilience-aware network design for SCADA systems
Genge, B., & Siaterlis, C. (2014) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2013.11.018 · Cited by 30 · see citing works
“However, information from already available documentation can also be reused, since industrial processes are subject to safety analysis [9] and this procedure documents the functionality of each component.”
BackgroundMethodEDMAND: Edge-Based Multi-Level Anomaly Detection for SCADA Networks
Ren, W., Yardley, T. M., & Nahrstedt, K. (2018) · IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) · doi:10.1109/smartgridcomm.2018.8587533 · Cited by 29 · see citing works
“while [6]–[10] analyze ICS protocol functions.”
A flexible acquisition cycle for incompletely defined fieldbus protocols
Găitan, V. G., Găitan, N. C., & Ungurean, I. (2014) · ISA Transactions · doi:10.1016/j.isatra.2014.02.006 · Cited by 27 · see citing works
Standard specification-based intrusion detection for hierarchical industrial control systems
Hotellier, E., Sicard, F., Francq, J., & Mocanu, S. (2024) · Information Sciences · doi:10.1016/j.ins.2024.120102 · Cited by 26 · see citing works
Genge, B., Haller, P., & Kiss, I. (2016) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2016.06.003 · Cited by 26 · see citing works
Mo, H., Li, Y., & Zio, E. (2016) · Applied Energy · doi:10.1016/j.apenergy.2016.09.041 · Cited by 26 · see citing works
SICARD, F., ZAMAI, É., & FLAUS, J.-M. (2019) · Reliability Engineering & System Safety · doi:10.1016/j.ress.2019.03.020 · Cited by 25 · see citing works
Data-Driven Correlation of Cyber and Physical Anomalies for Holistic System Health Monitoring
Marino, D., Wickramasinghe, C. S., Tsouvalas, B., Rieger, C. G., & Manic, M. (2021) · IEEE Access · doi:10.1109/access.2021.3131274 · Cited by 23 · see citing works
“…the evaluation of a systems cybersecurity by investigating specific attacks such as malware attacks [23–25], attacks on communication protocols [26–28], DOS attacks [25, 29], Man-In-the-Middle attacks [30], false sequential [31], data or code injection attacks[32], and other integrity attacks…”
BackgroundA General Real-Time Control Approach of Intrusion Response for Industrial Automation Systems
Huang, S., Zhou, C., Xiong, N. N., Yang, S., Qin, Y., & Zhang, Q. (2015) · IEEE Transactions on Systems Man and Cybernetics Systems · doi:10.1109/tsmc.2015.2469688 · Cited by 23 · see citing works
Advance hybrid key management architecture for SCADA network security
Rezai, A., Keshavarzi, P., & Moravej, Z. (2016) · Security and Communication Networks · doi:10.1002/sec.1612 · Cited by 22 · see citing works
An Evaluation of Machine Learning Algorithms To Detect Attacks in Scada Network
Tamy, S., Belhadaoui, H., Rabbah, M. A., Rabbah, N., & Rifi, M. (2019) · Mediterranean Congress of Telecommunications (CMT) · doi:10.1109/cmt.2019.8931327 · Cited by 20 · see citing works
“Paper [3] identifies attacks that can be carried out against ICS.”
BackgroundGaggero, G. B., Rossi, M., Girdinio, P., et al. (2020) · Journal of Sensor and Actuator Networks · doi:10.3390/jsan9020020 · Cited by 21 · see citing works
“Industrial Control Systems (ICS) present some unique features that distinguish them from traditional ICT environments: commonly used protocols present many vulnerabilities [9] that can be exploited by using Man in the Middle (MITM) attacks [10]; and approaches to security based only on traffic analysis could fail [11].”
BackgroundA Software-Defined Security Approach for Securing Field Zones in Industrial Control Systems
Yang, J. Y., Zhou, C., Tian, Y., & Yang, S. (2019) · IEEE Access · doi:10.1109/access.2019.2924800 · Cited by 19 · see citing works
“This physical propagation of damages in the physical domain may cause the whole system to fail [6].”
BackgroundMethodSCADA security: a review and enhancement for DNP3 based systems
Jain, P., & Tripathi, P. (2013) · CSI Transactions on ICT · doi:10.1007/s40012-013-0024-2 · Cited by 30 · see citing works
False Data Injection Attack Targeting the LTC Transformers to Disrupt Smart Grid Operation
Anwar, A., Mahmood, A. N., & Ahmed, M. (2015) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-319-23802-9_20 · Cited by 18 · see citing works
“Vulnerabilities of DNP3 protocols are discussed in [7] where authors design firewalls based on the monitoring and analysis of the system states.”
BackgroundSecurity Monitoring for Industrial Control Systems
Coletta, A., & Armando, A. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-40385-4_4 · Cited by 16 · see citing works
Self-citationPanda, A. R., Mishra, D., & Ratha, H. K. (2016) · Journal of Industrial Information Integration · doi:10.1016/j.jii.2016.07.001 · Cited by 15 · see citing works
Add-On Anomaly Threshold Technique for Improving Unsupervised Intrusion Detection on SCADA Data
Almalawi, A., Fahad, A., Tari, Z., Khan, A. I., Alzahrani, N., Bakhsh, S. T., Alassafi, M. O., Alshdadi, A., & Qaiyum, S. (2020) · Electronics · doi:10.3390/electronics9061017 · Cited by 14 · see citing works
“In [11], the authors proposed an analytical approach to manually identify the range of critical states for multivariate process parameters, and the identified ranges are then used to monitor the critical state of the analysed process parameters.”
MethodRule-based anomaly detection for railway signalling networks
Heinrich, M., Gölz, A., Arul, T., et al. (2023) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2023.100603 · Cited by 14 · see citing works
“[8] show that current firewall generations cannot detect attacks that are based on licit commands.”
BackgroundModel-based IDS design for ICSs
Monzer, M.-H., Beydoun, K., Ghaith, A., & Flaus, J. (2022) · Reliability Engineering & System Safety · doi:10.1016/j.ress.2022.108571 · Cited by 14 · see citing works
Data fusion-base anomay detection in networked critical infrastructures
Genge, B., Siaterlis, C., & Καρόπουλος, Γ. (2013) · International Conference on Dependable Systems and Networks workshops · doi:10.1109/dsnw.2013.6615505 · Cited by 14 · see citing works
“[11], [12], [13] builds on the assumption that every attack on NCIs will ultimately lead to a transition of the system from a secure state to a critical state.”
BackgroundIntrusion Detection for Sequence-Based Attacks with Reduced Traffic Models
Ferling, B., Chromik, J. J., Caselli, M., & Remke, A. (2018) · Lecture notes in computer science · doi:10.1007/978-3-319-74947-1_4 · Cited by 14 · see citing works
A Review on Malware Analysis for IoT and Android System
Yadav, C. S., & Gupta, S. (2022) · SN Computer Science · doi:10.1007/s42979-022-01543-w · Cited by 13 · see citing works
“[211] stated that rule based approach provides inadequate protections because the system may be crash or function may behave maliciously due to licit commands and leads to an unsafe state.”
BackgroundOn the practical integration of anomaly detection techniques in industrial control applications
Haller, P., Genge, B., & Duka, A.-V. (2018) · International Journal of Critical Infrastructure Protection · doi:10.1016/j.ijcip.2018.10.008 · Cited by 13 · see citing works
Evaluation of Industrial Firewall Performance Issues in Automation and Control Networks
Zvabva, D., Zavarsky, P., Butakov, S., et al. (2018) · Biennial Symposium on Communications · doi:10.1109/bsc.2018.8494696 · Cited by 12 · see citing works
Power utility automation cybersecurity: IEC 61850 specification of an intrusion detection function
Kabir-Querrec, M., Mocanu, S., Thiriet, J.-M., et al. (2015) · CRC Press eBooks · doi:10.1201/b19094-205 · Cited by 11 · see citing works
Content-based deep communication control for networked control system
Wan, M., Shang, W., Kong, L., & Zeng, P. (2016) · Telecommunication Systems · doi:10.1007/s11235-016-0223-x · Cited by 10 · see citing works
“Compared with other existing communication control approaches for the networked control system [18,27,28], our rule granularity is finer.”
Process-aware SCADA traffic monitoring : a local approach
Chromik, J. J. (2019) · doi:10.3990/1.9789036548014 · Cited by 10 · see citing works
Sicard, F., Zamai, É., & Flaus, J.-M. (2018) · Diagnosability, Security and Safety of Hybrid Dynamic and Cyber-Physical Systems · doi:10.1007/978-3-319-74962-4_5 · Cited by 10 · see citing works
Multichannel Emulator for Resistance Temperature Detectors (RTDs)
Ricci, S. (2024) · IEEE Transactions on Industrial Electronics · doi:10.1109/tie.2024.3366220 · Cited by 9 · see citing works
“A bus distributes to all the chained boards the power and an RS-485 Modbus communication channel [23], [24] (Power & Bus in Fig.”
BackgroundGenge, B., Haller, P., & Roman, A.-S. (2023) · Applied Sciences · doi:10.3390/app13063409 · Cited by 9 · see citing works
Detection and localization of cyber attacks on water treatment systems: an entropy-based approach
Liu, K., Wang, M., Ma, R., Zhang, Z., & Wei, Q. (2022) · Frontiers of Information Technology & Electronic Engineering · doi:10.1631/fitee.2000546 · Cited by 9 · see citing works
“Water treatment systems (WTSs) are critical infrastructures that are related to national economic and social stability (Fovino et al., 2012; Wikipedia, 2020a).”
BackgroundSicard, F., Zamai, E., & Flaus, J.-M. (2018) · IFAC-PapersOnLine · doi:10.1016/j.ifacol.2018.09.541 · Cited by 9 · see citing works
Session Duration Based Feature Extraction for Network Intrusion Detection in Control System Networks
Ponomarev, S., & Atkison, T. (2016) · International Conference on Computational Science and Computational Intelligence (CSCI) · doi:10.1109/csci.2016.0173 · Cited by 8 · see citing works
“[12] developed a critical state based intrusion detection system that is able to prevent damage to physical plants.”
BackgroundMethods of Formal Analysis for ICS Protocols and HART - IP CPN modelling
Bhurke, A. U., & Kazi, F. (2021) · Asian Conference on Innovation in Technology (ASIANCON) · doi:10.1109/asiancon51346.2021.9544603 · Cited by 8 · see citing works
Introducing Security Mechanisms in OpenFog-Compliant Smart Buildings
Toral, I. M., Calvo, I., Villar, E., Gil-García, J. M., & Barambones, Ó. (2024) · Electronics · doi:10.3390/electronics13152900 · Cited by 7 · see citing works
Detecting Abnormal Behavior in SCADA Networks Using Normal Traffic Pattern Learning
Kim, B., Kang, D.-H., Na, J.-C., et al. (2014) · Lecture notes in electrical engineering · doi:10.1007/978-3-662-45402-2_18 · Cited by 7 · see citing works
Fagundes, F. D., & da Cunha, M. J. (2022) · Journal of Control Automation and Electrical Systems · doi:10.1007/s40313-021-00889-5 · Cited by 6 · see citing works
“The works presented by (Fovino et al. 2012) and (Cheminod et”
BackgroundInfluentialCyber security in production networks — An empirical study about the current status
Nüßer, W., Koch, E., Trsek, H., Schumann, R., & Mahrenholz, D. (2017) · IEEE International Conference on Emerging Technologies and Factory Automation (ETFA) · doi:10.1109/etfa.2017.8247725 · Cited by 6 · see citing works
“The establishment of a comprehensive security program in order to secure the OT devices against attacks has not been one of the main tasks on this priority list [2].”
BackgroundA Multi-Model-based Approach to Detect Cyber Stealth Attacks in Industrial Internet of Things
Calin, E., Sándor, H., & Genge, B. (2019) · International Conference on Software, Telecommunications and Computer Networks (SoftCOM) · doi:10.23919/softcom.2019.8903645 · Cited by 6 · see citing works
“[16], [17] builds on the assumption that every attack on ICS will ultimately lead to a transition of the system from a secure state to a critical state.”
BackgroundAn active transmission ModBus protocol based on Zigbee
Zheng, Y. (2014) · IEEE Workshop on Electronics, Computer and Applications (IWECA) · doi:10.1109/iweca.2014.6845583 · Cited by 6 · see citing works
Formal Verification of Security Pattern Composition: Application to SCADA
Fadi, O., & Dhaussy, P. (2019) · Computing and Informatics · doi:10.31577/cai_2019_5_1149 · Cited by 6 · see citing works
“Other studies [23, 15] aim to enhance the security level and fortify the provided services along with the managed critical data.”
BackgroundEA-GAT: Event aware graph attention network on cyber-physical systems
Yağcı, M. Y., & Aydın, M. A. (2024) · Computers in Industry · doi:10.1016/j.compind.2024.104097 · Cited by 5 · see citing works
Towards a Distributed Runtime Monitor for ICS/SCADA Systems
Wain, A., Reiff‐Marganiec, S., Jones, K., et al. (2016) · Electronic workshops in computing · doi:10.14236/ewic/ics2016.15 · Cited by 5 · see citing works
“…(Kumar et al. (2014)) which they benchmarked against the existing techniques: Vukovic et al. (2012)’s NAMDIA (Network-Aware Mitigation of Data Integrity Attacks), Morris Pavurapu (2010)’s Retrofit IDS (Intrusion Detection System), and Fovino et al. (2012)’s CSBF (Critical State-Based Filtering).”
BackgroundMethodAn active security defense strategy for wind farm based on automated decision
Lai, J., Duan, B., Su, Y., et al. (2017) · IEEE Power & Energy Society General Meeting (PESGM) · doi:10.1109/pesgm.2017.8274638 · Cited by 5 · see citing works
Hamming Code to Data Protection in a Modbus Industrial Communication: Experimental Results
Hugo, T. S., Urrea, C., John, K. M., et al. (2018) · IEEE Ecuador Technical Chapters Meeting (ETCM) · doi:10.1109/etcm.2018.8580291 · Cited by 5 · see citing works
“Nowadays many industrial applications use Modbus [4], which is a communications protocol based on the master/slave architecture and has greater availability for connecting industrial electronic devices [1], [5].”
BackgroundPredicting Railway Signalling Commands Using Neural Networks for Anomaly Detection
Heinrich, M., Renkel, D., Arul, T., et al. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-54549-9_11 · Cited by 5 · see citing works
Coletta, A. (2018) · doi:10.5121/csit.2018.80105 · Cited by 4 · see citing works
Self-citationArciniegas-Mejia, A. F., Imbajoa-Ruiz, D. E., & Javier Revelo, F. (2017) · Enfoque UTE · doi:10.29019/enfoqueute.v8n1.136 · Cited by 4 · see citing works
Intrusion Detection System of industrial control networks using network telemetry
Ponomarev, S. (2015) · Cited by 4 · see citing works
Enhancing CII firewall performance through hash based rule lookup
Lee, P. J., Guo, H., & Veeravalli, B. (2017) · IEEE Region 10 Conference (TENCON) · doi:10.1109/tencon.2017.8228242 · Cited by 4 · see citing works
“With cyber and physical attackers becoming more and more advanced with each passing minute, defense mechanisms are needed to ensure that the cyberphysical security of critical infocomm infrastructure (CII) systems is maintained [1, 2].”
BackgroundCross-layer anomaly detection in industrial cyber-physical systems
Sándor, H., Genge, B., Haller, P., Duka, A.-V., & Crainicu, B. (2017) · International Conference on Software, Telecommunications and Computer Networks (SoftCOM) · doi:10.23919/softcom.2017.8115523 · Cited by 3 · see citing works
“[9] assumed that every attack will ultimately lead to a transition of the system from a secure state to a critical state.”
BackgroundUsing Side-Channels to Detect Abnormal Behavior in Industrial Control Systems
Bolboacă, R., Genge, B., & Haller, P. (2019) · IEEE International Conference on Intelligent Computer Communication and Processing (ICCP) · doi:10.1109/iccp48234.2019.8959745 · Cited by 3 · see citing works
“While the field of anomaly detection especially in the industrial sector is gaining momentum [10], [11], [12], we believe that additional research is needed in order to explore the sidechannel specific parameters exposed by regular operations within ICS.”
BackgroundTime Synchronization of Medium Voltage Substation IEDs Using Modbus and Python
Owusu, J., Afful, A., Loung, V. Y. K., et al. (2021) · doi:10.1109/iscaie51753.2021.9431798 · Cited by 3 · see citing works
“Almost every industrial instrumentations and automation controls currently implement Modbus in their operations [10], which makes this approach widely acceptable.”
BackgroundIndustrial automation and control systems development future and challenges
Alward, Y., Singh, O., & Ansari, M. A. (2022) · Journal of Information and Optimization Sciences · doi:10.1080/02522667.2022.2036354 · Cited by 3 · see citing works
“The automation system process is widely applied in the different industrial fields, like natural oil and gas, water treatments, chemical fields, and smart grid [5-8].”
MethodEngineering Edge Security in Industrial Control Systems
Haller, P., Genge, B., & Duka, A.-V. (2019) · Advanced sciences and technologies for security applications · doi:10.1007/978-3-030-00024-0_10 · Cited by 2 · see citing works
Assisting the Configuration of Intelligent Safety Gateway
Toublanc, T., Bevan, R., de Lamotte, F. F., & Berruet, P. (2018) · Annual Conference of the IEEE Industrial Electronics Society (IECON) · doi:10.1109/iecon.2018.8591155 · Cited by 2 · see citing works
“Few studies have been conducted, most dealing with isolation of attacks such as: ”intelligent firewall” [1], or predictive detection and isolation of equipment [2].”
BackgroundCompound Cryptography for Internet of Things Based Industrial Automation
Prasath, J. S. (2021) · IntechOpen eBooks · doi:10.5772/intechopen.95845 · Cited by 2 · see citing works
ICSrank: A Security Assessment Framework for Industrial Control Systems (ICS)
Alhasawi, S. (2020) · Liverpool John Moores University · doi:10.24377/ljmu.t.00013480 · Cited by 2 · see citing works
The Role of One-Class Classification in Detecting Cyberattacks in Critical Infrastructures
Nader, P., Honeiné, P., & Beauseroy, P. (2016) · Lecture notes in computer science · doi:10.1007/978-3-319-31664-2_25 · Cited by 1 · see citing works
OLAF: Operation-level traffic analyzer framework for Smart Grid
Ren, W., Granda, S., Yardley, T., et al. (2016) · IEEE International Conference on Smart Grid Communications (SmartGridComm) · doi:10.1109/smartgridcomm.2016.7778819 · Cited by 1 · see citing works
“Different approaches include traffic filtering systems [7], [8], Bloom-filter-based/model-base/machine-learningbased intrusion detection [9]–[12], SCADA Intelligence Gateway [13] and a fine grained analysis of packet content [14].”
MethodInformation security risk-based inherently safer design for intelligent oil and gas pipeline systems
Hu, J., Xiao, S., & Chen, Y. (2023) · Methods in chemical process safety · doi:10.1016/bs.mcps.2023.05.009 · Cited by 2 · see citing works
Design of Circuit Breaker Monitoring System Based on MODBUS Protocol in Delphi Compiler Environment
Pang, Z., Cai, Z., Ma, S., et al. (2019) · International Conference on Electric Power Equipment – Switching Technology · doi:10.1109/icepe-st.2019.8928930 · Cited by 1 · see citing works
“The results of experiments verify that in the Delphi programming environment, the serial port communication software of the host computer based on Modbus RTU protocol is implemented and run successfully.”
BackgroundInfluentialHan, F., Hu, Y., Yu, D., et al. (2019) · IEEE International Conference on Signal Processing, Communications and Computing (ICSPCC) · doi:10.1109/icspcc46631.2019.8960725 · Cited by 1 · see citing works
“Devstack is a rapid automated deployment Bash script for Openstack developers, providing a source environment for assisting development and debugging [6].”
MethodWITHDRAWN: An improved two-way secure key supervision (tsks) scheme for secure scada
Kumar, N. R., Nandakumar, R., Meenaakshisundhari, R. P., et al. (2021) · Materials Today Proceedings · doi:10.1016/j.matpr.2020.12.1221 · Cited by 1 · see citing works
RetractedSurvey on Building Block Technologies
Tari, Z., Sohrabi, N., Samadi, Y., & Suaboot, J. (2023) · doi:10.1002/9781119898900.ch5 · Cited by 1 · see citing works
One-class classification for cyber intrusion detection in industrial systems
Nader, P. (2015) · doi:10.70675/fb6511f7z380bz4bd8zbeb1zf269916d70b9 · Cited by 1 · see citing works
“They have been conceived originally for serial communication when security was not crucial for control systems [Fovino et al., 2012].”
BackgroundModel-based IDS design pour ICS
Monzer, M.-H. (2020) · doi:10.70675/5d8845e0z776fz440ezac26z1f887b50497b · Cited by 1 · see citing works
Khare, R., & Rodrigues, F. B. (2014)
Coletta, A. (2018) · doi:10.5121/csit.2018.81807
Self-citationMelaragno, A. (2020) · IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech) · doi:10.1109/dasc-picom-cbdcom-cyberscitech49142.2020.00099
“In state-based firewalls, according to [14], the firewall tracks the state of the connections and requests that are made by outside entities.”
BackgroundA consideration of white list creating algorithm for industrial network protocols at network switch
Enomoto, M., Hosokawa, S., & Sawada, K. (2020) · Annual Conference of the Society of Instrument and Control Engineers of Japan (SICE) · doi:10.23919/sice48898.2020.9240340
“There is a method of introducing a filter to a communication between devices[1][2] or a method of applying an intrusion detection method[3][4].”
MethodSupervisory Control and Data Acquisition ( SCADA ): An Introduction
Tari, Z., Khalil, I., Almalawi, A., Fahad, A., Zomaya, A. Y., Mahmood, A. N., & Queiroz, C. (2016) · Wiley Encyclopedia of Electrical and Electronics Engineering · doi:10.1002/047134608x.w8319
Mo, H., Sansavini, G., & Xie, M. (2021) · doi:10.1002/9781119682707.refs
- Authors
- Nai Fovino, I., Coletta, A., Carcano, A., & Masera, M.
- Affiliations
- European Commission (BE)
- University of Insubria (IT)
- Venue
- IEEE Transactions on Industrial Electronics
- Published
- 2012-10
- Volume
- 59
- Issue
- 10
- Pages
- 3943-3950
- ISSN
- 0278-0046 (ISSN-L)
- 1557-9948
- OpenAlex
- W2005468743
- Semantic Scholar
- fe70d8403056956f99bc8e4ff407d8d5ad87e768
- Cited by
- 108
- References
- 28
- Citations by year
- 2026: 1 · 2025: 2 · 2024: 4 · 2023: 5 · 2022: 7 · 2021: 8 · 2020: 9 · 2019: 12 · 2018: 16 · 2017: 9 · 2016: 14 · 2015: 12 · 2014: 6 · 2013: 3
- FWCI
- 4.58
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- IEEE Transactions on Industrial Electronics (publishedVersion)
- Joint Research Centre (European Commission) (submittedVersion)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Control and Systems Engineering › Industrial Automation and Control Systems
- Keywords
- SCADA security, firewall design, attack detection, Modbus, DNP3, industrial control systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
