Contextual Intrusion Alerts for Scada Networks - An Ontology based Approach for Intrusion Alerts Post Processing

Abdullah Al Balushi, Kieran McLaughlin, Sakir Sezer

2016

Abstract

The complexity of modern SCADA networks and their associated cyber-attacks requires an expressive but flexible manner for representing both domain knowledge and collected intrusion alerts with the ability to integrate them for enhanced analytical capabilities and better understanding of attacks. This paper proposes an ontology-based approach for contextualized intrusion alerts in SCADA networks. In this approach, three security ontologies were developed to represent and store information on intrusion alerts, Modbus communications, and Modbus attack descriptions. This information is correlated into enriched intrusion alerts using simple ontology logic rules written in Semantic Query-Enhanced Web Rules (SQWRL). The contextualized alerts give analysts the means to better understand evolving attacks and to uncover the semantic relationships between sequences of individual attack events. The proposed system is illustrated by two use case scenarios.

References

  1. Cuppens, N., Cuppens, F., Autrel, F., and Debar, H. (2009). An ontology-based approach to react to network attacks. IJICS, 3(3-4):280-305.
  2. Drias, Z., Serhrouchni, A., and Vogel, O. (2015). Taxonomy of attacks on industrial control protocols. In ICPE and NTDS Conference, 2015, pages 1-6. IEEE.
  3. Frye, L., Cheng, L., and Heflin, J. (2012). An ontologybased system to identify complex network attacks. In IEEE (ICC), pages 6683-6688. IEEE.
  4. Hadz?iosmanovic, D., Sommer, R., Zambon, E., and Hartel, P. H. (2014). Through the eye of the plc: semantic security monitoring for industrial processes. In 30th ACSAC, pages 126-135. ACM.
  5. Huitsing, P., Chandia, R., Papa, M., and Shenoi, S. (2008). Attack taxonomies for the modbus protocols. IJCIP, 1:37-44.
  6. IDA, M. (2004). Modbus messaging on tcp/ip implementation guide v1. 0a.
  7. Mitchell, Robert, C. I.-R. (2014). A survey of intrusion detection techniques for cyber-physical systems. ACM Computing Surveys (CSUR), 46(4):55.
  8. Modbus (2012). Modbus application protocol specification v1. 1b3. Modbus Organization, Inc., April, 26.
  9. Peterson, D. (2009). Quickdraw: Generating security log events for legacy scada and control system devices. In CATCH'09, pages 227-229. IEEE.
  10. Roesch, M. (1999). Snort nids.
  11. Sadighian, A., Zargar, S. T., Fernandez, J. M., and Lemay, A. (2013). Semantic-based context-aware alert fusion for distributed intrusion detection systems. In (CRiSIS), pages 1-6. IEEE.
  12. Zhu, B., Joseph, A., and Sastry, S. (2011). A taxonomy of cyber attacks on scada systems. In 4th CPSCom, pages 380-388. IEEE.
Download


Paper Citation


in Harvard Style

Al Balushi A., McLaughlin K. and Sezer S. (2016). Contextual Intrusion Alerts for Scada Networks - An Ontology based Approach for Intrusion Alerts Post Processing . In Proceedings of the 2nd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-167-0, pages 457-464. DOI: 10.5220/0005745504570464


in Bibtex Style

@conference{icissp16,
author={Abdullah Al Balushi and Kieran McLaughlin and Sakir Sezer},
title={Contextual Intrusion Alerts for Scada Networks - An Ontology based Approach for Intrusion Alerts Post Processing},
booktitle={Proceedings of the 2nd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2016},
pages={457-464},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0005745504570464},
isbn={978-989-758-167-0},
}


in EndNote Style

TY - CONF
JO - Proceedings of the 2nd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Contextual Intrusion Alerts for Scada Networks - An Ontology based Approach for Intrusion Alerts Post Processing
SN - 978-989-758-167-0
AU - Al Balushi A.
AU - McLaughlin K.
AU - Sezer S.
PY - 2016
SP - 457
EP - 464
DO - 10.5220/0005745504570464