• Abstract and Figures
• Public Full-text

Louisiana Tech University Louisiana Tech Digital Commons Doctoral Dissertations Graduate School Summer 2015 Intrusion Detection System of industrial control networks using network telemetry Stanislav Ponomarev Louisiana Tech University Follow this and additional works at: https://digitalcommons.latech.edu/dissertations Part of the Computer Sciences Commons, Electrical and Computer Engineering Commons, and the Language and Literacy Education Commons Recommended Citation Ponomarev, Stanislav, "" (2015). Dissertation. 199. https://digitalcommons.latech.edu/dissertations/199 This Dissertation is brought to you for free and open access by the Graduate School at Louisiana Tech Digital Commons. It has been accepted for inclusion in Doctoral Dissertations by an authorized administrator of Louisiana Tech Digital Commons. For more information, please contact [email protected]. INTRUSION DETECTION SYSTEM OF INDUSTRIAL CONTROL NETWORKS USING NETWORK TELEMETRY. by Stanislav Ponomarev, B.S., M.S. A Dissertation Presented in Partial Fulfillment of the Requirements for the Degree Doctor of Philosophy COLLEGE OF ENGINEERING AND SCIENCE LOUISIANA TECH UNIVERSITY August 2015 ProQuest Number: 3664531 All rights reserved INFORMATION TO ALL USERS The quality of this reproduction is dependent upon the quality of the copy submitted. In the unlikely event that the author did not send a complete manuscript and there are missing pages, these will be noted. Also, if material had to be removed, a note will indicate the deletion. ProQuestQue ProQuest 3664531 Published by ProQuest LLC(2015). Copyright of the Dissertation is held by the Author. All rights reserved. This work is protected against unauthorized copying under Title 17, United States Code. Microform Edition © ProQuest LLC. ProQuest LLC 789 East Eisenhower Parkway P.O. Box 1346 Ann Arbor, Ml 48106-1346 LOUISIANA TECH UNIVERSITY THE GRADUATE SCHOOL May 21,2015 Date We hereby recommend that the dissertation prepared under our supervision by Stanislav Olegovich Ponomarev entitled_________________________________________________________________________________ Intrusion Detection System of Industrial Control Networks Using Network Telemetry. be accepted in partial fulfillment of the requirements for the Degree of Doctor of Philosophy in Engineering, with concentration in Cyberspace of Dissertation :arch Head of Department lent Recommendation concurred in: Advisory Committee Approved: proved: ior of Graduate Studies lean of the Graduate School Dean of the College GS Form 13a (6/07) ABSTRACT Industrial Control Systems (ICSs) are designed, implemented, and deployed in most major spheres of production, business, and entertainment. ICSs are commonly split into two subsystems - Programmable Logic Controllers (PLCs) and Supervisory Control And Data Acquisition (SCADA) systems - to achieve high safety, allow engineers to observe states of an ICS, and perform various configuration updates. Before wide adoption of the Internet, ICSs used “air-gap” security measures, where the ICS network was isolated from other networks, including the Internet, by a physical disconnect [1]. This level of security allowed ICS protocol designers to concentrate on the availability and safety of operation of physical systems while decreasing the need for many cyber security implementations. As the price of networking devices fell, and the Internet received global adoption, many businesses became interested in the benefits of attaching ICSs to wide and global area networks. However, since ICS network protocols were originally designed for an air-gapped environment, it did not include any of the security measures needed for a proper operation of a critical protocol that exposes its packets to the Internet. This dissertation designs, implements, and evaluates a telemetry based Intrusion Detection System (IDS). The designed IDS utilizes aggregation and analysis of the traffic telemetry features to classify the incoming packets as malicious or benign. An IDS that uses network telemetry was created, and it achieved a high classification accuracy, protecting nodes from malicious traffic. Such an IDS is not vulnerable to address or encryption spoofings, as it does not utilize the content of the packets to differentiate between malicious and benign traffic. The IDS uses features of timing and network sessions to determine whether the machine that sent a particular packet and its software is, in fact, a combination that is benign, as well as whether or not it resides on a network that is benign. The results of the experiments conducted for this dissertation establish that such system is possible to create and use in an environment of ICS networks. Several features are recognized and selected as means for fingerprinting the hardware and software characteristics of the SCADA system that can be used in pair with machine learning algorithms to allow for a high accuracy detection of intrusions into the ICS network. The results showed a classification accuracy of at least 95% is possible, and as the differences between machines increase, the accuracy increases too. APPROVAL FOR SCHOLARLY DISSEMINATION The author grants to the Prescott Memorial Library of Louisiana Tech University the right to reproduce, by appropriate methods, upon request, any or all portions of this Dissertation. It is understood that “proper request” consists o f the agreement, on the part o f the requesting party, that said reproduction is for his personal use and that subsequent reproduction will not occur without written approval of the author of this Dissertation. Further, any portions of the Dissertation used in books, papers, and other works must be appropriately referenced to this Dissertation. Finally, the author of this Dissertation reserves the right to publish freely, in the literature, at any time, any or all portions of this Dissertation. Author Date A * 21, 20l£ GS Form 14 (5/03) TABLE OF CONTENTS ABSTRACT...................................................................................................................... iii LIST OF TABLES............................................................................................................ ix LIST OF FIGURES............................................................................................................ x CHAPTER 1 INTRODUCTION................................................................................. 1 1.1 ICS Vulnerabilities ............................................................................................ 2 1.2 ICS Protocol Security ...................................................................................... 5 1.3 Intrusion Detection Systems ............................................................................. 6 CHAPTER 2 LITERATURE REVIEW..................................................................... 8 2.1 ICS Protocols..................................................................................................... 8 2.1.1 Modbus .................................................................................................... 9 2.1.2 DNP3........................................................................................................ 11 2.2 ICS Attacks ........................................................................................................ 13 2.2.1 SCADA-side Attacks ............................................................................. 14 2.2.2 PLC-side Attacks ................................................................................... 15 2.3 Intrusion Detection Systems for ICS ............................................................... 16 2.3.1 State Based ID S.................................................................................... 16 2.3.2 Rule Based ID S ...................................................................................... 18 2.3.3 Physical Properties Based IDS............................................................ 19 2.3.4 Statistical and Machine Learning IDS..................................................20 vi 2.3.5 Network Telemetry and Metadata Based IDS ....................................22 CHAPTER 3 NETWORK TELEMETRY BASED INTRUSION DETECTION SYSTEM....................................................................... 27 3.1 Telemetry Data ................................................................................................. 29 3.2 Classification Algorithms................................................................................ 33 3.3 Data Acquisition ............................................................................................... 35 CHAPTER 4 INTRUSION DETECTION OF MALICIOUS SSH CALLS 39 4.1 Experim ent........................................................................................................ 41 4.1.1 Experimental Setup.............................................................................. 41 4.2 Results................................................................................................................ 42 CHAPTER 5 SESSION INSTANTIATION............................................................... 46 5.1 TCP Session Flows.......................................................................................... 46 5.2 Session Duration Based Instantiation ............................................................ 48 5.3 Session Length Based Instantiation..................................................................52 5.4 Conclusion .........................................................................................................

Load more

  130

Copy Link