Rule-based intrusion detection system for SCADA networks

Increased interconnectivity of Supervisory Control and Data Acquisition (SCADA) systems in renewable power system networks can potentially mean greater susceptibility to malicious attackers. SCADA systems have inherent cyber vulnerabilities as these systems were originally designed with limited consideration of cyber attacks or threats. There is little published literature which rigorously considers SCADA-based Intrusion Detection System (IDS) using the IEC 608705-104 protocol. This paper presents a rule-based IDS for IEC 60870-5-104 driven SCADA networks using an in-depth protocol analysis and a Deep Packet Inspection (DPI) method. The proposed SCADA-IDS involving signature-based and model-based detection is exemplified using a protocol traffic case-study.