Enhancing SCADA Security: Developing a Host-Based Intrusion Detection System to Safeguard Against Cyberattacks

arXiv (Cornell University)

Abstract

With the increasing reliance of smart grids on correctly functioning SCADA systems and their vulnerability to cyberattacks, there is a pressing need for effective security measures. SCADA systems are prone to cyberattacks, posing risks to critical infrastructure. As there is a lack of host-based intrusion detection systems specifically designed for the stable nature of SCADA systems, the objective of this work is to propose a host-based intrusion detection system tailored for SCADA systems in smart grids. The proposed system utilizes USB device identification, flagging, and process memory scanning to monitor and detect anomalies in SCADA systems, providing enhanced security measures. Evaluation in three different scenarios demonstrates the tool's effectiveness in detecting and disabling malware. The proposed approach effectively identifies potential threats and enhances the security of SCADA systems in smart grids, providing a promising solution to protect against cyberattacks.

Authors 4

1. Ömer Sen Aachen

   Fraunhofer Institute for Applied Information Technology · RWTH Aachen University

   Affiliation as printed

   Digital Energy , Fraunhofer FIT , Aachen , Germany

   IAEW , RWTH Aachen University , Aachen , Germany -

2. Tarek M. Hassan Aachen

   RWTH Aachen University

   Affiliation as printed

   IAEW , RWTH Aachen University , Aachen , Germany -

3. Andreas Ulbig Aachen

   Fraunhofer Institute for Applied Information Technology · RWTH Aachen University

   Affiliation as printed

   Digital Energy , Fraunhofer FIT , Aachen , Germany

   IAEW , RWTH Aachen University , Aachen , Germany -

4. Martin Henze Aachen SPICe

   Fraunhofer Institute for Communication, Information Processing and Ergonomics · RWTH Aachen University

   Affiliation as printed

   CA&D , Fraunhofer FKIE , Wachtberg , Germany

   SPICe , RWTH Aachen University , Aachen , Germany -