Using a Specification-based Intrusion Detection System to Extend the DNP3 Protocol with Security Functionalities

Modern SCADA systems are increasingly adopting Inte rnet technologies to control distributed industrial asse t . As proprietary communication protocols are increasingly being used over public networks without efficient protection mechanisms, i t is increasingly easier for attackers to penetrate into the communication networks of companies that operate el ectrical power grids, water plants, and other critical infra st ucture systems. To provide protection against such attacks without changing legacy configurations, SCADA systems requi re an intrusion detection technique that can understand i nformation carried by network traffic based on proprietary SCA DA protocols. To achieve that goal, we adapted Bro, a specificati on-based intrusion detection system, for SCADA protocols in our previous work [13]. In that work, we built into Bro a new pa rser to support DNP3, a complex proprietary network protocol that i s widely used in SCADA systems for electrical power grids [4 ]. The builtin parser provides clear visibility of network even ts related to SCADA systems. The semantics associated with the ev nts provide us with a fine-grained operational context of he SCADA system, including types of operations and their par ameters. Based on such information, we propose in this work two se curity policies to perform authentication and integrity ch e king on observed SCADA network traffic. To evaluate the pro posed security policies, we simulated SCADA-specific atta ck scenarios in a test-bed, including real proprietary devices u sed in an electrical power grid. Experiments showed that the proposed intrusion detection system with the security polici es can work efficiently in a large industry control environment that can include approximately 4000 devices.