Causal reasoning about attacks in SCADA networks

Ren, Wenyu; Yardley, Timothy; Nahrstedt, Klara

Permalink

https://hdl.handle.net/2142/103425 Copy

Description

Title

Causal reasoning about attacks in SCADA networks

Author(s)

• Ren, Wenyu
• Yardley, Timothy
• Nahrstedt, Klara

Issue Date

2019-04

Keyword(s)

• Smart Grid
• SCADA
• causal analysis
• anomaly reasoning

Abstract

The Supervisory Control and Data Acquisition (SCADA) system is the most commonly used industrial control system but is subject to a wide range of serious threats. Intrusion detection systems are deployed to promote the security of SCADA systems, but they continuously generate tremendous number of alerts without further comprehending them. There is a need for an efficient system to correlate alerts and discover attack strategies to provide explainable situational awareness to SCADA operators. In this paper, we present a causal-polytree-based anomaly reasoning framework for SCADA networks, named CAPTAR. CAPTAR takes the meta-alerts from our previous anomaly detection framework EDMAND, correlates the them using a naive Bayes classifier, and matches them to predefined causal polytrees. Utilizing Bayesian inference on the causal polytrees, CAPTAR can produces a high-level view of the security state of the protected SCADA network. Experiments on a prototype of CAPTAR proves its anomaly reasoning ability and its capabilities of satisfying the real-time reasoning requirement.

Type of Resource

text

Permalink

http://hdl.handle.net/2142/103425

Sponsor(s)/Grant Number(s)

DE-OE0000780

Owning Collections