Authors:
Henrik Waagsnes
and
Nils Ulltveit-Moe
Affiliation:
University of Agder, Norway
Keyword(s):
IDS, Test Framework, SCADA, IEC 60870-5-104, SIEM.
Related
Ontology
Subjects/Areas/Topics:
Computer-Supported Education
;
Enterprise Information Systems
;
Information Systems Analysis and Specification
;
Information Technologies Supporting Learning
;
Internet Technology
;
Intrusion Detection and Response
;
Security
;
Security and Privacy
;
Web Information Systems and Technologies
Abstract:
This paper presents a SCADA intrusion detection system test framework that simulates SCADA traffic and
detects malicious network activity. The framework combines several existing components such as Kali Linux,
Conpot, QTester104 and OpenMUC in a virtual machine based framework to provide realistic SCADA traffic.
It is agnostic to Intrusion Detection System (IDS) type, and is demonstrated in a case study comparing two
popular signature-based IDS engines: Suricata and Snort. The IDS engines include rule-sets for the IEC
60870-5-104 and other SCADA protocols. Detected events from IDS sensors are sent to a distributed Elastic
cluster which visualises them using Kibana dashboards. The experiments show that there is some difference in
behaviour between Suricata and Snort’s ability to detect malicious traffic using the same SCADA ruleset, but
these issues are relatively easy to mitigate. The IDS test framework also measures the latency from detection
and until the IDS alerts are pr
esented in the incident management system, which shows that Suricata has
slightly better performance than Snort.
(More)