Anomaly Detection in Cyclic Communication in OT Protocols

Enhanced Modbus/TCP Security Protocol: Authentication and Authorization Functions Supported

The Zero Trust concept is being adopted in information technology (IT) deployments, while human users remain to be the main risk for operational technology (OT) deployments. This article proposes to enhance the new Modbus/TCP Security protocol with authentication and authorization functions that guarantee security against intentional unauthorized access. It aims to comply with the principle of never trusting the person who is accessing the network before carrying out a security check. Two functions are tested and used in order to build an access control method that is based on a username and a password for human users with knowledge of industrial automation control systems (IACS), using simple means, low motivation, and few resources. A man-in-the-middle (MITM) component was added in order to intermediate the client and the server communication and to validate these functions. The proposed scenario was implemented using the Node-RED programming platform. The tests implementing the functions and the access control method through the Node-RED software have proven their potential and their applicability.

Heuristic Intrusion Detection Based on Traffic Flow Statistical Analysis

As telecommunications are becoming increasingly important for modern systems, ensuring secure data transmission is getting more and more critical. Specialised numerous devices that form smart grids are a potential attack vector and therefore is a challenge for cybersecurity. It requires the continuous development of methods to counteract this risk. This paper presents a heuristic approach to detecting threats in network traffic using statistical analysis of packet flows. The important advantage of this method is ability of intrusion detection also in encrypted transmissions. Flow information is processing by neural networks to detect malicious traffic. The architectures of subsequent versions of the artificial neural networks were generated based on the results obtained by previous iterations by searching the hyperparameter space, resulting in more refined models. Finally, the networks prepared in this way exhibited high performance while maintaining a small size—thereby making them an effective method of attacks detection in network environment to protect smart grids.