Attacking IEC-60870-5-104 SCADA Systems

Panagiotis Radoglou-Grammatikis∗ , Panagiotis Sarigiannidis∗ , Ioannis Giannoulakis†

Emmanouil Kafetzakis† , Emmanouil Panaousis‡
∗ University of Western Macedonia, Kozani, Greece
† Eight Bells Ltd, Nicosia, Cyprus
‡ University of Surrey, Guildford, UK

Abstract—The rapid evolution of the Information and Commu- vast amount of data generated by the various interconnections
nications Technology (ICT) services transforms the conventional makes it more difficult to establish appropriate access control
electrical grid into a new paradigm called Smart Grid (SG). Even rules and policies. In the context of SG, the cyber attacks
though SG brings significant improvements, such as increased
reliability and better energy management, it also introduces mainly aim at compromising the availability of systems and
multiple security challenges. One of the main reasons for this secondly their integrity and confidentiality. For instance, the
is that SG combines a wide range of heterogeneous technologies, various kinds of Denial of Service (DoS) attacks can disrupt
including Internet of Things (IoT) devices as well as Supervisory the network functionality, thus resulting in disastrous conse-
Control and Data Acquisition (SCADA) systems. The latter quences, such as power outage and blackouts. On the other
are responsible for monitoring and controlling the automatic
procedures of energy transmission and distribution. Nevertheless, side, the False Data Injection (FDI) attacks can compromise
the presence of these systems introduces multiple vulnerabilities the data of smart meters, while the Man-in-the-Middle (MiTM)
because their protocols do not implement essential security attacks compromise the data privacy.
mechanisms such as authentication and access control. In this An integral part of SG is the Supervisory Control and
paper, we focus our attention on the security issues of the IEC Data Acquisition (SCADA) systems that are responsible for
60870-5-104 (IEC-104) protocol, which is widely utilized in the
European energy sector. In particular, we provide a SCADA monitoring and controlling automatic operations taking place
threat model based on a Coloured Petri Net (CPN) and emulate in a transmission or a distribution substation. The significant
four different types of cyber attacks against IEC-104. Last, we role of these systems, their constrained computing resources,
used AlienVault’s risk assessment model to evaluate the risk level as well as their legacy nature, making them an attractive
that each of these cyber attacks introduces to our system to target of cyber attackers. A successful cyber attack against
confirm our intuition about their severity.
Index Terms—SCADA security, Threat modelling, OSSIM,
SCADA systems may lead the adversary to control and
Coloured Petri Net, IEC-60870-5-104, Smart Grid affect the energy transmission and distribution functions. A
characteristic example is the Stuxnet worm, which targeted
I. I NTRODUCTION the Iranian nuclear programme. In addition, in 2015, Russian
cyber attackers attacked a Ukrainian substation resulting in the
With the advent of the Internet of Things (IoT), the tra- power outage for more than 225,000 people [3].
ditional electrical grid is transformed into a new paradigm There are many international communication standards uti-
called Smart Grid (SG) which combines Information and lized for the operation of SCADA systems. The most well-
Communication (ICT) services with the conventional opera- known are Modbus, Distributed Network Protocol (DNP3),
tions of the energy generation, transmission and distribution. Profinet, IEC-60870-5 and IEC-61850. In this paper, we focus
According to [1], SG will probably be the largest example of on the security of the IEC-60870-5-104 [4] (i.e., IEC-104)
the IoT technology, providing multiple benefits for both end- protocol. In 1995, the International Electromechanical Com-
users and utility companies. Using SGs, the utility companies mission (IEC) was released the IEC-60870-5-101 (i.e., IEC-
have the ability to monitor and control remotely all processes 101) protocol, which defines essential telecontrol messages
concerning the normal operation of the electrical grid, thus between a logic controller and a controlling server. Six years
enhancing their overall business model. On the other side, later, IEC-104 was proposed. This combines the applica-
energy consumers can monitor their energy consumption, tion messages of IEC-101 with the Transmission Control
resulting in more economical pricing and improving energy Protocol/Internet Protocol (TCP/IP), which itself introduces
management. multiple security challenges. Thus, IEC-104’s functionality is
Although SG offers multiple benefits, it also introduces based on TCP/IP which itself presents various vulnerabilities.
significant cybersecurity challenges [2]. In particular, SG con- Moreover, the application data is exchanged without any
stitutes a large-scale network consisting of various heteroge- authentication mechanism, i.e., as plaintext.
neous technologies such as IoT and legacy systems making In this paper, we investigate the security of IEC-104, by
cybersecurity a complex problem to address. For instance, the emulating four cyber attacks based on a theoretic threat model
constrained computing resources of IoT devices like smart which adopts a Coloured Petri Net (CPN). We also assessed
meters hinder the adoption of conventional security measures the risk, that each of these cyber attacks poses to the system,
such as asymmetric encryption mechanisms. Moreover, the using the AlienVault’s risk assessment model and real-world
data values from the Common Weakness Enumeration (CWE) and 3) deriving their risk levels using the AlienVault’s risk
category system. assessment model.
The rest of this paper is organized as follows. Section II
discusses relevant works on IEC-104 security. Section III III. BACKGROUND
provides a background on SCADA systems, IEC 60870-104
security and Petri nets. Section IV describes a CPN-based A. SCADA systems
threat model for SCADA systems. In Section V, we present
the implementation of four different attack types against IEC- SCADA systems mainly consist of 1) a Master Terminal
104 and we determine their associated risk level. Finally, Unit (MTU), 2) logic controllers, 3) communication interfaces
Section VI concludes this paper by summarizing its main and 4) a Human Machine Interface (HMI). MTU is a server
contributions and discussing ideas for future work. which communicates with the logic controllers that in turn
monitor the operations of the industrial environment by detect-
II. R ELATED W ORK ing and preventing possible malfunctions and anomaly states.
Examples of logic controllers are Programmable Logic Con-
In [5] E. Hodo et al. present an anomaly-based Intrusion trollers (PLC) and Remote Terminal Units (RTU). The com-
Detection System (IDS) for a SCADA simulated environment munication interfaces refer to the industrial protocols utilized
which utilizes the IEC-104 protocol. The authors create their for the communication between MTU and logic controllers.
own dataset, which includes passive Address Resolution Pro- Finally, HMI is a Graphical User Interface (GUI) application
tocol (ARP) poisoning attacks, DoS attacks and replay attacks which is installed in MTU and used by a system operator to
that replace legitimate packets with malicious ones. Based transmit commands to logic controllers and receive data from
on this dataset and utilizing the Waikato Environment for them. In this work, we focus on SCADA systems consisting of
Knowledge Analysis (WEKA) tool, they evaluated multiple PLC controllers that in turn consist of: 1) Processor, 2) Input
machine learning algorithms, such as Naive Bayes IBk, J48, Modules, 3) Output Modules, 4) Communication Module,
Random Forest, OneR, RandomTree and DecisionTable. J48 5) Memory Module and 6) Power Supply. In particular, the
and DecisionTable scored the best accuracy. Processor unit is the core of PLC, which has been programmed
In [6], Y. Yang et al. provide signature and specification to implement various logic functions and send commands to
rules for the IEC-104 protocol, by using the Snort IDS the Output Modules based on the data received by the Input
[7]. After studying the security of the specific protocol, the Modules. The Input and Output Modules denote the field
authors deployed attack signatures and specification rules for devices in an industrial environment, such as sensors, motors
the following attacks: 1) unauthorized read commands, 2) and valves. Furthermore, it is clear that PLC needs some
unauthorized reset commands, 3) unauthorized remote control communication ports to exchange data with MTU or other
and adjustment commands, 4) spontaneous packets storm, 5) PLCs and industrial modules. The Communication Modules
unauthorized interrogation commands, 6) buffer overflows, 7) of PLC are usually compatible with Recommended Standard
unauthorized broadcast requests and 8) IEC-104 port com- (RS) 232, RS 233, RS 485, Ethernet and Wi-Fi. Finally, the
munication. The difference between the attack signatures and Power Supply unit provides power to the Processor and the
specifications is that the former compares monitored data other modules.
with known cyber attack patterns, while the latter compares
monitored data with normal behavior patterns.
B. IEC 60870-5-104 Security
In [8], Y. Yang et al. also provide a specification-based
IDS for the IEC-104 protocol. The core of their system is The functionality of IEC-104 is based on the TCP/IP which
named Detection State Machine (DSM) and its functionality exhibits a number of security issues. Although the IEC 62351
is based on Finite State Machines (FSM) methodology. More [10] standard provides solutions and guidelines that enhance
detailed, the operation of IEC-104 is determined through the the security of IEC-101 and IEC-104, the industrial nature
correlations of FSM. In contrast to the traditional FSM-based of the SCADA systems using these protocols hinders their
systems, their implementation applies a set of alarms that are immediate upgrade. Consequently, besides the weaknesses
capable of distinguishing the protocol malfunctions. To deploy of the TCP/IP, a severe security issue of IEC-104 is that
and demonstrate their methodology, the authors employ the the data at the application layer is transmitted without inte-
Internet Traffic and Content Analysis (ITACA) software [9]. grating encryption mechanisms, thus making it possible the
Concerning, the evaluation results, the authors argue that the execution of traffic analysis and MiTM attacks. In addition,
True Positive Rate (TPR) and False Positive Rate (FPR) of many commands of the protocol, such as reset command,
their IDS are calculated at 100% and 0% respectively. interrogation commands, read commands, etc. do not integrate
Undoubtedly, all works mentioned above provide useful authentication mechanisms, thereby resulting in unauthorized
information and methodologies concerning the IEC-104 se- access. This vulnerability is crucial, since a cyber attacker
curity. Our paper intends to complement these works, by possesses the ability to control PLCs and possibly, the overall
1) providing a threat model based on CPN for the SCADA operation of an automation substation, thereby generating
system, 2) implementing four cyber attacks against IEC-104 disastrous consequences.
 TABLE I
T RANSITIONS OF SCADA S YSTEM BASED ON A C OLORED P ETRI N ET.

Transition Source Destination Transition

Flow Type
Number Place Place Description
The power supply component
1 Power Supply Flow Power Supply Processor
provides power to the processor
The power supply component
2 Power Supply Flow Power Supply Input Modules
provides power to the input modules
The power supply component
3 Power Supply Flow Power Supply Output Modules
provides power to the output modules
The input modules transmit signals
4 Data Flow Input Modules Processor
data to the processor
The processor handles the input signals
provided by the input modules and
5 Commands Flow Processor Output Modules
transmits control commands
to the output modules
The processor stores some control
6 Data Flow Processor Memory
data to the memory
The processor passes the control
7 Data Flow Processor Communication Module
data to the communication module
The control data is sent to MTU via
8 Data Flow Communication Module MTU
the communication module
The communication module receives
9 Data Flow MTU Communication Module
control data from the MTU
The receives
10 Commands Flow MTU Communication Module
control commands from the MTU

C. Petri Nets
Power Supply

MTU
2 1 3

Petri nets have been used successfully to describe various

synchronous and asynchronous physical phenomena as well as Output
Input Modules 4 Processor 5
communication processes, by depicting the information flows Modules
8 9 10
among the various elements [11]. The architecture of a Petri
net is commonly composed of the following elements: 1) 6
Communication
Place, 2) Transition, 3) Connection and 4) Token. A Place is 7
Module
an elliptical node which usually denotes a device or component Memory
sending data to another device (or component). Transition is a
rectangular and intermediate node between the Connection of Power supply

Data
two Places, where Connection is depicted by a directed arrow. Commands

Finally, Token depicted by a black circle denotes the type of

information transmitted between two Places. These elements Fig. 1. CPN-based SCADA Architecture.
cooperate with each other to depict the various information
flows taking place in an environment, by satisfying necessarily
the following rules: 1) all Connections must be directed, 2) a IV. T HREAT M ODELLING
Connection can only exist between a Place and a Transition, 3) A. CPN-based SCADA Architecture
Connections between Places are not allowed, 4) Connections
between Transitions are not allowed and 5) a Place can hold Fig. 1 depicts the transformation of a SCADA system
one or more Tokens. described by subsection III-A into a CPN. The components of
PLC, as well as MTU, consist of the various Places of CPN.
CPN is an extension of Petri Nets, where different types of Concerning the possible Transitions, Table I, explains them
information flows can be described, utilizing different Tokens in detail, utilizing the following labels: Transition Number,
called Tokens Colour. In this paper, we will use three Tokens Flow Type, Source Place, Destination Place and Transition
Colour. The first one is illustrated by a yellow triangle and Description. The Connections, as illustrated in Fig. 1, are
denotes the power flows transmitted by the Power Supply to all directed. Finally, three Tokens Colour are utilized; the
the other components of PLC. The second Token Colour is first one is depicted by a yellow triangle denotes the power
depicted by a blue circle and implies the data flows exchanged supply flows. These flows are directed by the Power Supply
by the various components and systems. Finally, the last Token to the other components of PLC. The second Token Colour is
Colour is depicted by an orange square, which in turn denotes illustrated by a blue circle and indicates the data flows. Data
the command flows. flows are defined between 1) Input Modules and Processor, 2)
Processor and Memory System, 3) Processor and Communi-
cation Module, 4) Communication Module and MTU. Finally,
OSSEC Agent Suricata OSSEC Agent
the last Token Colour is depicted by an orange rectangle OSSEC

and implies the command flows. Command flows are located

between 1) Processor and Output Modules and 2) MTU and
Communication Module. Based on this CPN-based SCADA AlienVault OSSIM
192.168.1.99
architecture, in the next subsection, we identify the potential
threats per transition.
SPAN
B. CPN-based Threat Model
Table II presents the threat model for IEC-104 SCADA Switch

systems, based on CPN of Fig. 1. In particular, we have

classified the possible threats into two categories: 1) Physical
Internal Network
Attacks and 2) cyber attacks. The first category denotes the
case where the attacker has physical and direct access to the
industrial environment, by destructing possible components or
changing the corresponding interfaces between them. For each
IEC-
QTester104
transition, the corresponding physical attacks are described Testserver

by Table II. The second class denotes those attacks where

the adversary cannot access the physical devices, but he/she
exploits the system vulnerabilities of IEC-104 to perform the MTU PLC
192.168.1.7 192.168.1.8
various malicious actions. In particular, we have identified OpenMUC

four possible categories of cyber attacks against IEC-104: j60870

Ettercap

1) Unauthorised Access, 2) MiTM attacks, 3) DoS attacks

and 4) Traffic Analysis attacks. Specific examples of these
attacks are emulated in the next section. As in the case of the Cyber Attacker
192.168.1.9
physical attacks, for each transition, Table II determines the
corresponding cyber attacks. Fig. 2. Testbed for emulating cyber attacks against IEC-104.

V. ATTACK E MULATION AND R ISK A SSESSMENT

The machine carrying Kali Linux and IP address
The purpose of this section is twofold. We first emulate 192.168.1.9 emulates the cyber attacker. The specific device
the cyber attacks determined by our threat model and second, is going to be used to perform the cyber attacks utilizing pre-
we identify their risk level by using the Alienvault’s risk installed penetration testing tools, such as Ettercap and hping,
assessment model adopted by AlienVault OSSIM [12]. as well as the OpenMUC j60870 software in order to transmit
unauthorized commands to PLC. In particular, OpenMUC
A. Testbed j60870 was developed based on Java and it includes only two
Fig. 2 illustrates the testbed used for emulating the afore- protocol commands: 1) Interrogation command (C IC NA 1)
mentioned cyber attacks against the IEC-104 protocol. In par- and 2) Clock Synchronization command (C CS NA 1). For
ticular, the device with IP address 192.168.1.8 plays the role of the purposes of the paper, we further extended its capabilities
a PLC using the IEC TestServer software. The latter emulates by integrating the Read command (C RD NA 1), the Reset
IEC-104 and its user interface consists of three panels, which command (C RP NA 1) and the Counter Interrogation com-
accordingly include settings for its operation, active commands mand (C CI NA 1).
and various information about its connections. The device with Finally, the device with the IP 192.168.1.99 corresponds
IP address 192.168.1.7 emulates an MTU which communicates to the AlienVault OSSIM which undertakes to monitor and
with the previous device utilizing the QTester104 software. protect PLC and MTU. OSSIM constitutes a System Infor-
The graphical interface of QTester104 is also divided into mation and Event Management (SIEM) system integrating
three panels. The first panel comprises various settings about multiple security tools and correlation mechanisms capable of
its operation. The lower left panel displays messages, such detecting possible anomalies and providing overall protection.
as errors, new connections and disconnections regarding the Concerning our testbed, OSSIM was configured to monitor and
communication between PLC and MTU. Finally, the lower control efficiently the communication between PLC and MTU.
right panel displays specific information of the aforementioned In particular, we firstly determined MTU and PLC as assets
communication, including the Information Object Address of OSSIM. Secondly, we deployed the corresponding policies
(IOA), the type of command, its value, the Cause of Trans- for these assets. Next, we activated the availability monitoring
mission (CoT), possible flags, the number of packets received agents for these assets, by employing the Nagios tool. Next,
by PLC and time information. we enabled and configured appropriately both Host Intrusion
 TABLE II
T HREAT M ODEL FOR IEC 60870-5-104 SCADA S YSTEMS .

Attacks on Power Attacks on Control Attacks on Control

Supply Flows Data Flows Command Flows
Transitions 1, 2, 3 4, 6, 7, 8, 9 5, 10
1) Physical disruption or
malicious modification of 1) Physical disruption or
the connections 4, 6, 7, 8 malicious modification of
1) Physical disruption or
and 9. the connections 5 and 10.
malicious modification of
2) Physical destruction or 2) Physical destruction or
the connections 1, 2 and 3.
malicious modification of malicious modification of
2) Physical destruction or
Physical Attacks the Processor, Input Modules the Processor, Output modules,
malicious modification of
Output Modules, Memory, Communication Module and MTU.
the Power Supply, Processor,
Communication Module and MTU. 3) Physical malicious
Input Modules and Output
3) Physical malicious programming of the Processor
Modules.
programming of the Processor 4) Physical violation of MTU
4) Physical violation of MTU of the SCADA system.
of the SCADA system.
1) Unauthorised access to Input
Modules
2) Unauthorised access to Processor
3) Unauthorised access to Output 1) Unauthorised access to Processor
1) Unauthorised access to
Modules 2) Unauthorised access to Output
Processor
4) MiTM attack between Input Modules
2) Unauthorised access to Input
Cyber attacks Modules and Processor 3) MiTM attack between
Modules
5) MiTM attack between Output Communication Module and MTU
3) Unauthorised access to Output
Modules and Processor 4) DoS attacks
Modules
6) DoS attacks 5. Traffic Analysis Attack
7) MiTM attack between
Communication Module and MTU
8. Traffic Analysis Attack

Detection System (HIDS) and Network Intrusion Detection by 12%. Accordingly, the network utilization rate increased by
System (NIDS) tools, called OSSEC and Suricata, respectively. 4.81%. This attack did not disrupt the communication between
For this process, we utilized and adjusted the rules of [6]. PLC and MTU. Nevertheless, it should be noted that in a
Finally, Suricata should be able to monitor the whole network real environment where PLC is characterized by constrained
traffic. To this end, OSSIM was configured to employ a SPAN computing resources, this attack may be more successful.
(Switch Port Analyzer) port. Furthermore, if there were more cyber attackers, the effect
of the attack would be different. Finally, it should be noted
B. Attacks Emulation
that OSSIM successfully detected this attack.
In the following, we summarise the attacks we emulated as Unauthorized Access. Normally, an unauthorized user
part of our testbed. For each attack, we describe its purpose should not be able to communicate with PLC; however, as
and a high-level view of how it is undertaken. mentioned before IEC-104 does not provide any authentication
IEC-104 Packet Flooding Attack. This attack constitutes mechanism. To emulate this attack, we modified appropriately
a kind of DoS which aims at flooding MTU with specific IEC- the IP address of the cyber attacker; hence, he/she is not
104 command packets in order to mainly generate a possible considered as a member of the network. Subsequently, we
malfunction to MTU, confuse the system operator or even utilized the OpenMUC j60870 software to transmit the follow-
disrupt the operation of MTU. To emulate this attack, we ing commands: 1) Read command (C RD NA 1), 2) Reset
configured PLC to transmit the single point information com- Process command (C RP NA 1) and 3) Counter Interrogation
mand (M SP NA 1) to MTU per second. The functionality command (C CI NA 1). OSSIM detected all of these actions.
of MTU was not affected by this attack. Nevertheless, If there MiTM IEC 60870-5-104 Isolation Attack. We carried out
were more PLCs, it is likely that MTU would present certain a MiTM attack in which the cyber attacker aims at isolating
malfunction. Moreover, it is noteworthy that OSSIM was not and dropping the IEC-104 network traffic between PLC and
able to detect the attack, since this action does not violate any MTU. To this end, we performed an ARP poisoning attack
security rules of Suricata and OSSEC. utilizing the Ettercap software. In addition, we developed and
TCP SYN DoS Attack. The TCP SYN Attack is a usual enabled an Ettercap filter which isolates and drops the IEC-
DoS attack that the cyber attacker continuously transmits 104 packets between PLC and MTU. As in the previous cases,
to PLC several SYN packets without remaining the corre- OSSIM timely recognized the attack.
sponding answers (SYN+ACK). To emulate this attack, we
utilized the pre-installed hping tool of Kali Linux. During the C. Risk Assessment For IEC 60870-5-104
specific attack, the Central Processing Unit (CPU) usage rate In the following, we are using a use case, to derive the over-
increased 23%, while the memory utilization rate increased all risk level that each attack type, implemented as part of our
 TABLE III
R ISK A SSESSMENT VALUES

Threat CWE Vulnerability Threat Occurrence Impact

DoS Attacks Allocation of Resources Without Limits or Throttling (CWE-770) 8.65 3.5
Traffic Analysis Attacks Cleartext Transmission of Sensitive Information (CWE-319) 7.834 2.5
MiTM Attacks Missing Encryption of Sensitive Data (CWE-311) 6.793 3.5
Unauthorized Access Improper Access Control (CWE-284) 9.4 3.5

testbed, introduces. The definition of the final expected risk is capable of identifying possible anomalies and zero-day attacks
in line with AlienVault’s risk assessment model [12]: Risk = against IEC-104 communications. The proposed system will
(Asset V alue × Event P riority × Event Reliability)/25, be integrated into OSSIM utilizing the jailbreak interface.
where each security event is related to the detection of the Moreover, the proposed IDS will apply machine learning and
threat that inflicts this risk. Asset Value (ranging between 0-5) statistical analysis techniques on TCP/IP network flows and it
is assigned by each organization and implies how significant will keep statistics (e.g., number of packets, bytes) for each
an asset is. In our testbed, there are two assets: 1) MTU IEC-104 packet, by monitoring the IEC-104 transactions based
and 2) PLC whose value is equal to 5, since they are crucial on Common Address of ASDU (CoA), IOA and CoT.
for the normal operation of a SCADA system. Event priority
VII. ACKNOWLEDGEMENT
(ranging between 0-5) is determined by the expected impact
of this threat, while event reliability (ranging between 0-10) This project has received funding from the European
is determined by the probability of the threat occurring. Union’s Horizon 2020 research and innovation programme
We have used impact, threat occurrence values from the under grant agreement No. 787011 (SPEAR).
case study presented in [13] to initialize Event Priority and R EFERENCES
Event Reliability respectively. These values were computed by
[1] S. Tan, D. De, W. Song, J. Yang, and S. K. Das, “Survey of security
using real-world data from the Common Weakness Enumer- advances in smart grid: A data driven approach,” IEEE Communications
ation (CWE) category system for software weaknesses and Surveys Tutorials, vol. 19, no. 1, pp. 397–422, Firstquarter 2017.
vulnerabilities. Table III presents these values for each of the [2] P. I. Radoglou-Grammatikis and P. G. Sarigiannidis, “Securing the smart
grid: A comprehensive compilation of intrusion detection and prevention
identified attacks of our testbed implementation. systems,” IEEE Access, vol. 7, pp. 46 595–46 620, 2019.
[3] A. Hansen, J. Staggs, and S. Shenoi, “Security analysis of an advanced
Risk Assessment metering infrastructure,” International Journal of Critical Infrastructure
Protection, vol. 18, pp. 3 – 19, 2017.
Unauthorized Access 6.58 [4] P. Matoušek, “Description and analysis of iec 104 protocol,” Faculty
of Information Technology, Brno University o Technology, Tech. Rep.,
MiTM Attacks 4.76
2017.
Traffic Analysis Attacks 3.92 [5] E. Hodo, S. Grebeniuk, H. Ruotsalainen, and P. Tavolato, “Anomaly
DoS Attacks 6.06 detection for simulated iec-60870-5-104 trafiic,” in Proceedings of the
12th International Conference on Availability, Reliability and Security,
ser. ARES ’17. New York, NY, USA: ACM, 2017, pp. 100:1–100:7.
[Online]. Available: http://doi.acm.org/10.1145/3098954.3103166
Fig. 3. Risk assessment values for the various IEC-104 attacks. [6] Y. Yang, K. McLaughlin, T. Littler, S. Sezer, B. Pranggono, and H. F.
Wang, “Intrusion detection system for iec 60870-5-104 based scada
Fig. 3 depicts that Unauthorized Access and DoS attacks networks,” in 2013 IEEE Power Energy Society General Meeting, July
introduce the highest risk levels among the other two cyber 2013, pp. 1–5.
[7] W. Park and S. Ahn, “Performance comparison and detection analysis
threats modelled; Traffic Analysis and MiTM. This confirms in snort and suricata environment,” Wireless Personal Communications,
our intuition that the possible access poses the highest risks vol. 94, no. 2, pp. 241–252, May 2017. [Online]. Available:
to critical infrastructures such as a SCADA system. On the https://doi.org/10.1007/s11277-016-3209-9
[8] Y. Yang, K. McLaughlin, S. Sezer, Y. B. Yuan, and W. Huang, “Stateful
other hand, traffic analysis and any kind of MiTM introduce intrusion detection for iec 60870-5-104 scada security,” in 2014 IEEE
a fair amount risk as they can be the first step towards getting PES General Meeting — Conference Exposition, July 2014, pp. 1–5.
access to the system. [9] J. Hurley, A. Munoz, and S. Sezer, “Itaca: Flexible, scalable network
analysis,” in 2012 IEEE International Conference on Communications
(ICC), June 2012, pp. 1069–1073.
VI. C ONCLUSIONS [10] R. Schlegel, S. Obermeier, and J. Schneider, “A security evaluation of
iec 62351,” Journal of Information Security and Applications, vol. 34,
The security of SCADA systems is crucial for the overall pp. 197 – 204, 2017.
protection of the smart grid. The protocols used by these [11] T. M. Chen, J. C. Sanchez-Aarnoutse, and J. Buford, “Petri net modeling
systems present various security issues, since they usually of cyber-physical attacks on smart grid,” IEEE Transactions on Smart
Grid, vol. 2, no. 4, pp. 741–749, 2011.
combine the TCP/IP transform capabilities with legacy ap- [12] AlienVault, “Alienvault ossim documentation,” https://www.alienvault.
plication messages. In this paper, we focused on IEC-104 com/documentation/.
and we provided a threat model for it. We also emulated [13] A. Fielder, E. Panaousis, P. Malacaria, C. Hankin, and F. Smeraldi,
“Decision support approaches for cyber security investment,” Decision
and evaluated four critical cyber attacks against IEC-104. In Support Systems, vol. 86, pp. 13–23, 2016.
our future work, we aim to develop an IDS which will be