Skip to main content
SpringerLink
Log in

Improving SIEM for Critical SCADA Water Infrastructures Using Machine Learning

  • Conference paper
  • First Online:
Book cover Computer Security (SECPRE 2018, CyberICPS 2018)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 11387))

Abstract

Network Control Systems (NAC) have been used in many industrial processes. They aim to reduce the human factor burden and efficiently handle the complex process and communication of those systems. Supervisory control and data acquisition (SCADA) systems are used in industrial, infrastructure and facility processes (e.g. manufacturing, fabrication, oil and water pipelines, building ventilation, etc.) Like other Internet of Things (IoT) implementations, SCADA systems are vulnerable to cyber-attacks, therefore, a robust anomaly detection is a major requirement. However, having an accurate anomaly detection system is not an easy task, due to the difficulty to differentiate between cyber-attacks and system internal failures (e.g. hardware failures). In this paper, we present a model that detects anomaly events in a water system controlled by SCADA. Six Machine Learning techniques have been used in building and evaluating the model. The model classifies different anomaly events including hardware failures (e.g. sensor failures), sabotage and cyber-attacks (e.g. DoS and Spoofing). Unlike other detection systems, our proposed work helps in accelerating the mitigation process by notifying the operator with additional information when an anomaly occurs. This additional information includes the probability and confidence level of event(s) occurring. The model is trained and tested using a real-world dataset.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://github.com/AbertayMachineLearningGroup/machine-learning-SIEM-water-infrastructure.

References

  1. Adepu, S., Mathur, A.: Distributed detection of single-stage multipoint cyber attacks in a water treatment plant. In: Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, pp. 449–460. ACM (2016)

    Google Scholar 

  2. Ahmed, I., Roussev, V., Johnson, W., Senthivel, S., Sudhakaran, S.: A SCADA system testbed for cybersecurity and forensic research and pedagogy. In: Proceedings of the 2nd Annual Industrial Control System Security Workshop, pp. 1–9. ACM (2016)

    Google Scholar 

  3. Amin, S., Litrico, X., Sastry, S.S., Bayen, A.M.: Cyber security of water scada systems-part ii: attack detection using enhanced hydrodynamic models. IEEE Trans. Control. Syst. Technol. 21(5), 1679–1693 (2013)

    Article  Google Scholar 

  4. Amin, S., Litrico, X., Sastry, S., Bayen, A.M.: Cyber security of water scada systems-part i: analysis and experimentation of stealthy deception attacks. IEEE Trans. Control. Syst. Technol. 21(5), 1963–1970 (2013)

    Article  Google Scholar 

  5. Barber, D.: Bayesian Reasoning and Machine Learning. Cambridge University Press, Cambridge (2012)

    MATH  Google Scholar 

  6. Bellekens, X., et al.: Cyber-physical-security model for safety-critical IoT infrastructures. In: Wireless World Research Forum Meeting, vol. 35 (2015)

    Google Scholar 

  7. Brenner, J.F.: Eyes wide shut: the growing threat of cyber attacks on industrial control systems. Bull. At. Sci. 69(5), 15–20 (2013). https://doi.org/10.1177/0096340213501372

    Article  Google Scholar 

  8. Bujari, A., Furini, M., Mandreoli, F., Martoglia, R., Montangero, M., Ronzani, D.: Standards, security and business models: key challenges for the iot scenario. Mob. Netw. Appl. 23(1), 147–154 (2018)

    Article  Google Scholar 

  9. Calderón Godoy, A.J., González Pérez, I.: Integration of sensor and actuator networks and the scada system to promote the migration of the legacy flexible manufacturing system towards the industry 4.0 concept. J. Sens. Actuator Netw. 7(2), 23 (2018)

    Article  Google Scholar 

  10. Cárdenas, A.A., Amin, S., Lin, Z.S., Huang, Y.L., Huang, C.Y., Sastry, S.: Attacks against process control systems: risk assessment, detection, and response. In: Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security, pp. 355–366. ACM (2011)

    Google Scholar 

  11. Cheng, L., Tian, K., Yao, D.D.: Orpheus: Enforcing cyber-physical execution semantics to defend against data-oriented attacks. In: Proceedings of the 33rd Annual Computer Security Applications Conference, pp. 315–326. ACM (2017)

    Google Scholar 

  12. Gupta, B., Agrawal, D.P., Yamaguchi, S., Arachchilage, N.A., Veluru, S.: Editorial security, privacy, and forensics in the critical infrastructure: advances and future directions (2017)

    Article  Google Scholar 

  13. Hindy, H., et al.: A taxonomy and survey of intrusion detection system design techniques, network threats and datasets. arXiv preprint arXiv:1806.03517 (2018)

  14. Hindy, H., Hodo, E., Bayne, E., Seeam, A., Atkinson, R., Bellekens, X.: A taxonomy of malicious traffic for intrusion detection systems. In: Proceedings of the Cyber SA 2018. IEEE, June 2018

    Google Scholar 

  15. Huitsing, P., Chandia, R., Papa, M., Shenoi, S.: Attack taxonomies for the modbus protocols. Int. J. Crit. Infrastruct. Prot. 1, 37–44 (2008)

    Article  Google Scholar 

  16. Jensen, E.T.: Computer attacks on critical national infrastructure: a use of force invoking the right of self-defense. Stanf. J. Int. Law 38, 207 (2002)

    Google Scholar 

  17. Jiang, N., Lin, H., Yin, Z., Xi, C.: Research of paired industrial firewalls in defense-in-depth architecture of integrated manufacturing or production system. In: 2017 IEEE International Conference on Information and Automation (ICIA), pp. 523–526. IEEE (2017)

    Google Scholar 

  18. Hosmer Jr., D.W., Lemeshow, S., Sturdivant, R.X.: Applied Logistic Regression, vol. 398. Wiley, Hoboken (2013)

    Book  Google Scholar 

  19. Langner, R.: Stuxnet: dissecting a cyberwarfare weapon. IEEE Secur. Priv. 9(3), 49–51 (2011). https://doi.org/10.1109/MSP.2011.67

    Article  Google Scholar 

  20. Larose, D.T., Larose, C.D.: Discovering Knowledge in Data: An Introduction to Data Mining. Wiley, Hoboken (2014)

    MATH  Google Scholar 

  21. Laso, P.M., Brosset, D., Puentes, J.: Dataset of anomalies and malicious acts in a cyber-physical subsystem (2017). https://doi.org/10.1016/j.dib.2017.07.038, http://www.sciencedirect.com/science/article/pii/S2352340917303402, iD: 311593

    Article  Google Scholar 

  22. Lee, R.M., Assante, M.J., Conway, T.: Analysis of the cyber attack on the Ukrainian power grid. SANS ICS Report (2016)

    Google Scholar 

  23. Lior, R.: Data Mining with Decision Trees: Theory and Applications, vol. 81. World Scientific, Singapore (2014)

    Google Scholar 

  24. Mathur, A.: On the limits of detecting process anomalies in critical infrastructure. In: Proceedings of the 4th ACM Workshop on Cyber-Physical System Security, p. 1. ACM (2018)

    Google Scholar 

  25. Mitchell, R., Chen, I.R.: A survey of intrusion detection techniques for cyber-physical systems. ACM Comput. Surv. 46(4), 55:1–55:29 (2014). https://doi.org/10.1145/2542049

    Article  Google Scholar 

  26. Steinwart, I., Christmann, A.: Support Vector Machines. Springer, Heidelberg (2008). https://doi.org/10.1007/978-0-387-77242-4

    Book  MATH  Google Scholar 

  27. Tan, E.E.: Cyber Deterrence in Singapore: Framework & Recommendations, RSIS Working Paper, No. 309. Nanyang Technological University, Singapore (2018)

    Google Scholar 

  28. Ten, C.W., Manimaran, G., Liu, C.C.: Cybersecurity for critical infrastructures: attack and defense modeling. IEEE Trans. Syst. Man Cybern.-Part A: Syst. Hum. 40(4), 853–865 (2010)

    Article  Google Scholar 

  29. VanderPlas, J.: Python Data Science Handbook: Essential Tools for Working with Data. O’ Reilly Media, Inc., Sebastopol (2016)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Division of Cyber Security, Abertay University, Dundee, Scotland, UK

    Hanan Hindy, Ethan Bayne & Xavier Bellekens

  2. Naval Academy Research Institute, Brest, France

    David Brosset

  3. Department of Computer Science, Middlesex University, Flic-en-Flac, Mauritius

    Amar Seeam

Authors
  1. Hanan Hindy
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. David Brosset
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Ethan Bayne
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Amar Seeam
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Xavier Bellekens
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Hanan Hindy .

Editor information

Editors and Affiliations

  1. Norwegian University of Science and Technology, Gjøvik, Norway

    Sokratis K. Katsikas

  2. IMT Atlantique, Cesson-Sévigné, France

    Frédéric Cuppens

  3. IMT Atlantique, Cesson-Sévigné, France

    Nora Cuppens

  4. University of Piraeus, Piraeus, Greece

    Costas Lambrinoudakis

  5. Georgia Institute of Technology, Atlanta, GA, USA

    Annie Antón

  6. University of the Aegean, Karlovasi, Greece

    Stefanos Gritzalis

  7. University of Toronto, Toronto, ON, Canada

    John Mylopoulos

  8. University of the Aegean, Mytilene, Greece

    Christos Kalloniatis

Rights and permissions

Reprints and permissions

Copyright information

© 2019 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Hindy, H., Brosset, D., Bayne, E., Seeam, A., Bellekens, X. (2019). Improving SIEM for Critical SCADA Water Infrastructures Using Machine Learning. In: Katsikas, S., et al. Computer Security. SECPRE CyberICPS 2018 2018. Lecture Notes in Computer Science(), vol 11387. Springer, Cham. https://doi.org/10.1007/978-3-030-12786-2_1

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-12786-2_1

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-12785-5

  • Online ISBN: 978-3-030-12786-2

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation