An event buffer flooding attack in DNP3 controlled SCADA systems
Abstract
The DNP3 protocol is widely used in SCADA systems (particularly electrical power) as a means of communicating observed sensor state information back to a control center. Typical architectures using DNP3 have a two level hierarchy, where a specialized data aggregator receives observed state from devices within a local region, and the control center collects the aggregated state from the data aggregator. The DNP3 communications are asynchronous across the two levels; this leads to the possibility of completely filling a data aggregator's buffer of pending events, when a compromised relay sends overly many (false) events to the data aggregator. This paper investigates the attack by implementing the attack using real SCADA system hardware and software. A Discrete-Time Markov Chain (DTMC) model is developed for understanding conditions under which the attack is successful and effective. The model is validated by a Möbius simulation model and data collected on a real SCADA testbed.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Chabuksawar et al. used Command and Control WindTunnel as a simulation framework based on HLA to simulate a plant, its controller and the interconnecting network.
“Chabuksawar et al. [46] used Command and Control (C2) WindTunnel as a simulation framework (based on HLA) [47] to simulate a plant, its controller and the interconnecting network.”
From Assessing and augmenting SCADA cyber security: A survey of techniques (2017) · cites this paper as [46]
Cites
Cyber security risk assessment for SCADA and DCS networks
Ralston, P. A. S., Graham, J. H., & Hieb, J. L. (2007) · ISA Transactions · doi:10.1016/j.isatra.2007.04.003 · Cited by 267 · see citing works
DNPSec: Distributed network protocol version 3 (DNP3) security framework
Majdalawieh, M., Parisi-Presicce, F., & Wijesekera, D. (2007) · Advances in Computer, Information, and Systems Sciences, and Engineering · doi:10.1007/1-4020-5261-8_36 · Cited by 95 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Assessing and augmenting SCADA cyber security: A survey of techniques
Nazir, S., Patel, S., & Patel, D. (2017) · Computers & Security · doi:10.1016/j.cose.2017.06.010 · Cited by 167 · see citing works
“Other recent protocols, such as Distributed Network Protocol 3.0 (DNP3) also have their vulnerabilities [5], [38], [39] and packets can also be analysed [36] through network sniffing tools to gain information and cause damage.”
BackgroundMethodInfluentialThe Study of Security Issues for the Industrial Control Systems Communication Protocols
Wanying, Q., Weimin, W., Surong, Z., & Yan, Z. (2015) · Proceedings of the 2015 Joint International Mechanical, Electronic and Information Technology Conference · doi:10.2991/jimet-15.2015.129 · Cited by 14 · see citing works
- Authors
- Jin, D., Nicol, D. M., & Yan, G.
- Affiliations
- University of Illinois Urbana-Champaign (US)
- Los Alamos National Laboratory (US)
- Venue
- Proceedings of the 2011 Winter Simulation Conference (WSC)
- Publisher
- IEEE
- Published
- 2011-12
- Pages
- 2614-2626
- ISSN
- 0891-7736 (ISSN-L)
- OpenAlex
- W4253138776
- Cited by
- 56
- References
- 2
- Citations by year
- 2026: 2 · 2025: 2 · 2024: 6 · 2023: 6 · 2022: 5 · 2021: 5 · 2020: 4 · 2019: 3 · 2018: 3 · 2017: 4 · 2016: 3 · 2015: 6 · 2014: 4 · 2013: 3
- FWCI
- 3.75
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Winter Simulation Conference (publishedVersion)
- Funders
- U.S. Department of Energy
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- DNP3, SCADA security, data aggregators, discrete-time Markov chains, power system communication
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
