Home > Research > Publications & Outputs > Evaluation of Anomaly Detection Techniques for ...

Electronic data

Links

Text available via DOI:

View graph of relations

Evaluation of Anomaly Detection Techniques for SCADA Communication Resilience

Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSNConference contribution/Paperpeer-review

Published

Standard

Evaluation of Anomaly Detection Techniques for SCADA Communication Resilience. / Shirazi, Syed Noor Ul Hassan ; Gouglidis, Antonios; Syeda, Kanza Noor; Simpson, Steven; Mauthe, Andreas Ulrich; Stephanakis, Ioannis M. ; Hutchison, David.

Resilience Week (RWS), 2016. IEEE, 2016. p. 140-145.

Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSNConference contribution/Paperpeer-review

Harvard

Shirazi, SNUH, Gouglidis, A, Syeda, KN, Simpson, S, Mauthe, AU, Stephanakis, IM & Hutchison, D 2016, Evaluation of Anomaly Detection Techniques for SCADA Communication Resilience. in Resilience Week (RWS), 2016. IEEE, pp. 140-145, 4th International Symposium on Resilient Communication Systems, Chicago, United States, 16/08/16. https://doi.org/10.1109/RWEEK.2016.7573322

APA

Vancouver

Author

Bibtex

@inproceedings{f032e2e0218246878fb8f1907004295b,
title = "Evaluation of Anomaly Detection Techniques for SCADA Communication Resilience",
abstract = "Attacks on critical infrastructures{\textquoteright} Supervisory Control and Data Acquisition (SCADA) systems are beginning to increase. They are often initiated by highly skilled attackers, who are capable of deploying sophisticated attacks to exfiltrate data or even to cause physical damage. In this paper, we rehearse the rationale for protecting against cyber attacks and evaluate a set of Anomaly Detection (AD) techniques in detecting attacks by analysing traffic captured in a SCADA network. For this purpose, we have implemented a tool chain with a reference implementation of various state-of-the-art AD techniques to detect attacks, which manifest themselves as anomalies. Specifically, in order to evaluate the AD techniques, we apply our tool chain on a dataset created from a gas pipeline SCADA system in Mississippi State University{\textquoteright}s lab, which include artefacts of both normal operations and cyber attack scenarios. Our evaluation elaborate on several performance metrics of the examined AD techniquessuch as precision; recall; accuracy; F-score and G-score. The results indicate that detection rate may change significantly when considering various attack types and different detections modes (i.e., supervised and unsupervised), and also provide indications that there is a need for a robust, and preferably real-time AD technique to introduce resilience in critical infrastructures.",
author = "Shirazi, {Syed Noor Ul Hassan} and Antonios Gouglidis and Syeda, {Kanza Noor} and Steven Simpson and Mauthe, {Andreas Ulrich} and Stephanakis, {Ioannis M.} and David Hutchison",
year = "2016",
month = aug,
day = "16",
doi = "10.1109/RWEEK.2016.7573322",
language = "English",
isbn = "9781509020034",
pages = "140--145",
booktitle = "Resilience Week (RWS), 2016",
publisher = "IEEE",
note = "4th International Symposium on Resilient Communication Systems ; Conference date: 16-08-2016 Through 18-08-2016",
url = "http://www.resilienceweek.com/",

}

RIS

TY - GEN

T1 - Evaluation of Anomaly Detection Techniques for SCADA Communication Resilience

AU - Shirazi, Syed Noor Ul Hassan

AU - Gouglidis, Antonios

AU - Syeda, Kanza Noor

AU - Simpson, Steven

AU - Mauthe, Andreas Ulrich

AU - Stephanakis, Ioannis M.

AU - Hutchison, David

PY - 2016/8/16

Y1 - 2016/8/16

N2 - Attacks on critical infrastructures’ Supervisory Control and Data Acquisition (SCADA) systems are beginning to increase. They are often initiated by highly skilled attackers, who are capable of deploying sophisticated attacks to exfiltrate data or even to cause physical damage. In this paper, we rehearse the rationale for protecting against cyber attacks and evaluate a set of Anomaly Detection (AD) techniques in detecting attacks by analysing traffic captured in a SCADA network. For this purpose, we have implemented a tool chain with a reference implementation of various state-of-the-art AD techniques to detect attacks, which manifest themselves as anomalies. Specifically, in order to evaluate the AD techniques, we apply our tool chain on a dataset created from a gas pipeline SCADA system in Mississippi State University’s lab, which include artefacts of both normal operations and cyber attack scenarios. Our evaluation elaborate on several performance metrics of the examined AD techniquessuch as precision; recall; accuracy; F-score and G-score. The results indicate that detection rate may change significantly when considering various attack types and different detections modes (i.e., supervised and unsupervised), and also provide indications that there is a need for a robust, and preferably real-time AD technique to introduce resilience in critical infrastructures.

AB - Attacks on critical infrastructures’ Supervisory Control and Data Acquisition (SCADA) systems are beginning to increase. They are often initiated by highly skilled attackers, who are capable of deploying sophisticated attacks to exfiltrate data or even to cause physical damage. In this paper, we rehearse the rationale for protecting against cyber attacks and evaluate a set of Anomaly Detection (AD) techniques in detecting attacks by analysing traffic captured in a SCADA network. For this purpose, we have implemented a tool chain with a reference implementation of various state-of-the-art AD techniques to detect attacks, which manifest themselves as anomalies. Specifically, in order to evaluate the AD techniques, we apply our tool chain on a dataset created from a gas pipeline SCADA system in Mississippi State University’s lab, which include artefacts of both normal operations and cyber attack scenarios. Our evaluation elaborate on several performance metrics of the examined AD techniquessuch as precision; recall; accuracy; F-score and G-score. The results indicate that detection rate may change significantly when considering various attack types and different detections modes (i.e., supervised and unsupervised), and also provide indications that there is a need for a robust, and preferably real-time AD technique to introduce resilience in critical infrastructures.

U2 - 10.1109/RWEEK.2016.7573322

DO - 10.1109/RWEEK.2016.7573322

M3 - Conference contribution/Paper

SN - 9781509020034

SP - 140

EP - 145

BT - Resilience Week (RWS), 2016

PB - IEEE

T2 - 4th International Symposium on Resilient Communication Systems

Y2 - 16 August 2016 through 18 August 2016

ER -