Passive inference of attacks on SCADA communication protocols

摘要: The security of industrial Cyber-Physical Systems (CPS) has been recently receiving significant attention from the research community. While majority such originates control theory domain, very few works proposed viable approaches to problem practical perspective. In this work, we do not claim that propose a particular solution specific related CPS security, but rather present first look into what can help shape these solutions in future. Indeed, our vision and ultimate goal is attempt merge or at least diminish gap between highly theoretical derived insightful empirical experimentation, for securing CPS. Towards goal, believe specimen ever passive measurements real attacks on communication protocols. By analyzing recent one-week dataset rendered by 20 GB unsolicited traffic targeting half million routable, allocated unused Internet Protocol (IP) addresses, shed light attackers' intention actual Specifically, characterize terms their types, frequency, target protocols possible orchestration behavior. Our results demonstrate staggering 3 thousand scanning attempts close 2 denial service various One observation work fact attackers are interested exploiting Modbus protocol; contrast most literature extensively dedicating efforts devise secure models Modbus. We hope paper motivates design tailored leverage tangible vulnerabilities inferred measurements, achieve truly reliable