Secure BACnet Device Communication and Verification for MS/TP Networks

Industrial Control Systems (ICS) are critical in ensuring the efficient operation of various industrial processes. However, their increasing connectivity and integration with modern technologies have exposed them to a higher risk of cyber threats and intrusions. This paper examines potential threats that adversaries pose to BACnet’s Master-Slave/Token-Passing (MS/TP) networks. By exploiting vulnerabilities in the physical layer, attackers can disrupt BACnet systems remotely or through direct physical access. Hence, this work analyzes the possibilities and challenges for hardware or network-based solutions to secure BACnet MS/TP devices. First, we look into the vulnerability assessment and conceptual attack models. Then, we experimentally verify our attacker model and attack scenarios. Next, we analyze our result, and based on the findings, we also propose a countermeasure from network and physical security perspectives. As a result, An Intrusion Detection System (IDS) was built in this study, using tree-based algorithms specifically designed to accommodate the distinctive characteristics of BAC-net devices inside MS/TP networks. The performance metrics examination indicates the associated results for the Decision Tree (DT), Random Forest (RF), Logistic Regression (LR), and K-Nearest Neighbors: 100%, 100%, 98%, and 98%. Finally, this paper presents a novel intrusion detection method designed for BACnet MS/TP networks, addressing the challenges posed by these environments’ complex and dynamic nature.