Industrial control system security-malware botnet detection

Industrial realize that SCADA System was built without considering the security aspect. It was believe that there will be no attacks go to the SCADA plant using malware, such as botnet. Botnets are now the key platform for many Internet attacks, such as spam, distributed denial-of-service (DDoS), identity theft, and phishing. Most of the current botnet detection approaches work only on specific botnet command and control (C&C) protocols (e.g., IRC) and structures (e.g., centralized), and can become ineffective as botnets change their C&C techniques. In this research, we study vertexnet malware attack on a SCADA Server so that it can identify a SCADA Operator machine. The identification was used by analyzing and comparing process list which is run on the infecting host, so the attacker didn't take the wrong target, taking over the SCADA and sending some command to disrupt or operate the plant or machine, and to identifying of Botnet Vertexnet function and activity. From the experiment conducted, we get result that botnet Vertexnet can identifying SCADA Operator, taking over the server, and the activity can be detected effectively and efficiently.