Files in this item



application/pdftech_report.pdf (1MB)
Updated title.PDF


Title:Causal reasoning about attacks in SCADA networks
Author(s):Ren, Wenyu; Yardley, Timothy; Nahrstedt, Klara
Subject(s):Smart Grid
causal analysis
anomaly reasoning
Abstract:The Supervisory Control and Data Acquisition (SCADA) system is the most commonly used industrial control system but is subject to a wide range of serious threats. Intrusion detection systems are deployed to promote the security of SCADA systems, but they continuously generate tremendous number of alerts without further comprehending them. There is a need for an efficient system to correlate alerts and discover attack strategies to provide explainable situational awareness to SCADA operators. In this paper, we present a causal-polytree-based anomaly reasoning framework for SCADA networks, named CAPTAR. CAPTAR takes the meta-alerts from our previous anomaly detection framework EDMAND, correlates the them using a naive Bayes classifier, and matches them to predefined causal polytrees. Utilizing Bayesian inference on the causal polytrees, CAPTAR can produces a high-level view of the security state of the protected SCADA network. Experiments on a prototype of CAPTAR proves its anomaly reasoning ability and its capabilities of satisfying the real-time reasoning requirement.
Issue Date:2019-04
Genre:Technical Report
Date Available in IDEALS:2019-04-08

This item appears in the following Collection(s)

Item Statistics