Оглавление
Xun Yi. SCADA Security
Table of Contents
List of Tables
List of Illustrations
Guide
Pages
SCADA SECURITY: MACHINE LEARNING CONCEPTS FOR INTRUSION DETECTION AND PREVENTION. SCADA-BASED IDs SECURITY
FOREWORD
PREFACE
ACRONYMS
CHAPTER 1 Introduction
1.1 Overview
1.2 EXISTING SOLUTIONS
1.3 SIGNIFICANT RESEARCH PROBLEMS
1.4 BOOK FOCUS
1.5 BOOK ORGANIZATION
Note
CHAPTER 2 Background
2.1 SCADA SYSTEMS
2.1.1 Main Components
2.1.2 Architecture
Monolothic systems (First Generation)
Distributed systems (Second Generation)
Networked systems (Third Generation)
2.1.3 Protocols
2.2 INTRUSION DETECTION SYSTEM (IDS)
2.2.1 SCADA Network‐Based
2.2.2 SCADA Application‐Based
2.3 IDS Approaches
Signature‐based
SCADA anomaly‐based
CHAPTER 3 SCADA‐Based Security Testbed
3.1 MOTIVATION
3.2 GUIDELINES TO BUILDING A SCADA SECURITY TESTBED
3.3 SCADAVT DETAILS
3.3.1 The Communication Infrastructure
CORE architecture
The selection features
3.3.2 Computer‐Based SCADA Components
Modbus/TCP Simulators of Master/Slave
Modbus/TCP Simulator of HMI Server
I/O Modules Simulator
3.3.3 SCADA Protocols's Implementation
3.3.4 Linking Internal/External World Components
The IOModules Protocol
3.3.5 Simulation of a Controlled Environment
3.4 SCADAVT APPLICATION
3.4.1 The SCADAVT Setup
3.4.2 The Water Distribution System Setup
3.4.3 SCADA System Setup for WDS
3.4.4 Configuration Steps
3.5 ATTACK SCENARIOS
3.5.1 Denial of Service (DoS) Attacks
3.5.2 Integrity Attacks
3.6 CONCLUSION
3.7 APPENDIX FOR THIS CHAPTER
3.7.1 Modbus Registers Mapping
3.7.2 The Configuration of IOModuleGate
CHAPTER 4 Efficient k‐Nearest Neighbour Approach Based on Various‐Widths Clustering
4.1 INTRODUCTION
4.2 RELATED WORK
4.3 THE NNVWC APPROACH
4.3.1 FWC Algorithm and Its Limitations
4.3.2 Various‐Widths Clustering
Partitioning process
Merging process
Parameters
4.3.3 The ‐NN Search
Definition 4.1 Definition[k‐nearest neighbors]
Definition 4.2 [Candidate cluster for an object ]
4.4 EXPERIMENTAL EVALUATION
4.4.1 Data Sets
4.4.2 Performance Metrics
Reduction Rate of Distance Computations
Reduction Rate of Computation Time
4.4.3 Impact of Cluster Size
4.4.4 Baseline Methods
KD‐tree
Ball tree
Cover tree
FWC
4.4.5 Distance Metric
4.4.6 Complexity Metrics
Search Time
Construction Time
4.5 CONCLUSION
Chapter 5 SCADA Data‐Driven Anomaly Detection
5.1 INTRODUCTION
5.2 SDAD APPROACH
5.2.1 Observation State of SCADA Points
Definition 5.1 [Observation of SCADA points]
Definition 5.2 [Inconsistent/consistent observation]
5.2.2 Separation of Inconsistent Observations
Inconsistency scoring
The Separation Threshold
5.2.3 Extracting Proximity‐Detection Rules
5.2.4 Inconsistency Detection
5.3 EXPERIMENTAL SETUP
5.3.1 System Setup
5.3.2 WDS Scenario
5.3.3 Attack Scenario
5.3.4 Data Sets
Simulated Data Sets
Real Data Sets
5.3.5 Normalization
5.4 RESULTS AND ANALYSIS
5.4.1 Accuracy Metrics
5.4.2 Separation Accuracy of Inconsistent Observations
5.4.3 Detection Accuracy
‐Means Algorithm
SDAD Evaluation
5.5 SDAD LIMITATIONS
5.6 CONCLUSION
CHAPTER 6 A Global Anomaly Threshold to Unsupervised Detection
6.1 INTRODUCTION
6.2 RELATED WORK
6.3 GATUD APPROACH
6.3.1 Learning of Most‐Representative Data Sets
Step 1: Anomaly Scoring
Step 2: Selection of Candidate Sets
6.3.2 Decision‐Making Model
Illustrative Example
6.4 EXPERIMENTAL SETUP
6.4.1 Choice of Parameters
6.4.2 The Candidate Classifiers
6.5 RESULTS AND DISCUSSION
6.5.1 Integrating GATUD into SDAD
Results of the Separation Process With/Without GATUD,
Results of Proximity Detection Rules With/Without GATUD
6.5.2 Integrating GATUD into the Clustering‐based Method
6.6 CONCLUSION
CHAPTER 7 Threshold Password‐Authenticated Secret Sharing Protocols
7.1 MOTIVATION
7.2 EXISTING SOLUTIONS
7.3 DEFINITION OF SECURITY
Participants, Initialization, Passwords, Secrets
Execution of the Protocol
Correctness
Freshness
Advantage of the Adversary
Definition 7.1
Definition 7.2
7.4 TPASS PROTOCOLS
7.4.1 Protocol‐Based on Two‐Phase Commitment. Initialization
Parameter Generation
Password Generation
Secret Sharing
Protocol Execution
(A) Retrieval Request
(B) Retrieval Response
Commitment Phase
Opening Phase
(C) Secret Retrieval
7.4.2 Protocol Based on Zero‐Knowledge Proof. Initialization
Protocol Execution
(A) Retrieval Request
(B) Retrieval Response
(C) Secret Retrieval
7.4.3 Correctness. Correctness of the TPASS Protocol Based on Two‐Phase Commitment
Correctness of the TPASS Protocol Based on Zero‐Knowledge Proof
7.4.4 Efficiency. Efficiency of the TPASS Protocol Based on Two‐Phase Commitment
Efficiency of the TPASS Protocol Based on Zero‐Knowledge Proof
7.5 SECURITY ANALYSIS. 7.5.1 Security Analysis of the TPASS Protocol Based on Two‐Phase Commitment
Theorem 1
Proof
Experiment
Claim 1
Experiment
Claim 2
Experiment
Claim 3
Experiment
Claim 4
Experiment
Claim 5
Theorem 2
Proof
For the first subcase,
Experiment
Claim 6
Experiment
Claim 7
For the second subcase,
Experiment
Claim 8
7.5.2 Security Analysis of the TPASS Protocol Based on Zero‐Knowledge Proof
Noninteractive Zero‐Knowledge Proof of Knowledge Assumption
Theorem 3
Proof
Claim 3'
Claim 4'
Theorem 4
7.6 EXPERIMENTS
7.6.1 Performance of Initialization
7.6.2 Performance of Retrieve
7.7 CONCLUSION
CHAPTER 8 Conclusion
SUMMARY
A Framework for SCADA Security Testbed (SCADAVT)
An Efficient Search for k‐NN in Large and High‐Dimensional Data
Clustering‐Based Proximity Rules for SCADA Anomaly Detection
Towards Global Anomaly Threshold to Unsupervised Detection
FUTURE WORK
REFERENCES
INDEX
Wiley Series on Parallel and Distributed Computing
WILEY END USER LICENSE AGREEMENT
