See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/286570733

Petri net model of insider attacks in SCADA system

Conference Paper · September 2014

DOI: 10.1109/ISCISC.2014.6994022

CITATIONS READS

10 163

2 authors:

Payam Mahmoudi-Nasr A. Yazdian Varjani

University of Mazandara Tarbiat Modares University
8 PUBLICATIONS   39 CITATIONS    139 PUBLICATIONS   2,647 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

PHD Thesis View project

herbicide dose and weed density effects on crop:weed competition View project

All content following this page was uploaded by Payam Mahmoudi-Nasr on 27 May 2020.

The user has requested enhancement of the downloaded file.

Petri Net Model of Insider Attacks in SCADA System
Payam Mahmoudi Nasr Ali Yazdian Varjani
Electronic and Computer Engineering Dep. Electronic and Computer Engineering Dep.
Tarbiat Modares University Tarbiat Modares University
Tehran, Iran Tehran, Iran
[email protected] [email protected]

Abstract—This paper investigates the use of Petri nets for total incidents reported in 2010 [4]. Ben Salem et al. [5] by
modeling insider attacks on the Supervisory Control and Data distinguishing between intruders and traitors as two cases of
Acquisition (SCADA) system. Insider attacks are one of the most insider attacker, have provided proposed solutions for insider
dangerous threats for Critical Infrastructures (CIs). An insider attack detection in the computer security research literature.
attacker, by sending legitimate control commands, can bring
Petri nets (PNs) are well-known tools for studying and
catastrophic damages to CIs at the national level. Therefore, it is
important to develop new model to study the sequence of the modeling attacks in vulnerable systems. A CPN based attack
operator actions in the CIs. Many CIs are monitored and model of malicious insider attacks is described in [6]. Chen et
controlled by SCADA systems. This paper proposes a new al. [7] have used Petri nets for modeling coordinated cyber-
modelling approach of operator behavior, for resolving alarms physical attacks on the smart grid. Henry et al. [8] have used
and insider attacks, in electric power SCADA. In order to study Petri net analysis to clear the potential for attacker control of
operator behavior, several attack scenarios have been studied to resources for quantifying the risk of computer network
evaluate offered model. The proposed model is based on Colored operations against SCADA systems. Bouchti et al. [9] have
Petri Nets (CPNs). presented a CPN based approach to model the cyber-attack for
SCADA systems. Petri net as a modelling technique for
Insider attack; SCADA; colored petri net
SCADA systems under cyber-attacks is presented in [10].
I. INTRODUCTION Baracaldo et al. [11] have used a formulation of CPN to identify
Supervisory Control and Data Acquisition (SCADA) systems when an insider attacker may infer unauthorized permissions.
Allen et al. [12] are proposed a solution to the anomaly
are used in many CI applications such as power, water, oil and
detection problem, based on resource-based Petri net model, for
gas distribution systems, transport monitoring (e.g., railway,
event-based systems that use shared resources to interact
airports), and production systems. SCADA reliability and its between processes.
security operations are important for national security and Based on our studies, although alarms are a main factor in
economic activity. In the past, SCADA systems relied on SCADA system, there is no alarm-driven model for insider
Proprietary networks and non-standard protocols to protect attacks in SCADA. In this paper, we aim to show that alarms
against attacks [1], whereas today SCADA architectures have can be used to model insider attacks on the SCADA system.
taken advantage of high speed networking that uses The main contribution of this paper is a new alarm based CPN
standardized open protocols such as Ethernet over TCP/IP. This model for electric power SCADA operations. Our CPN model
allows sharing of real-time data processing and remote access consist of operator behavior in two parts: (i) resolving alarms
capabilities for operations and services. These changes have (ii) operator attacks. To demonstrate proposed CPN model,
increased the vulnerabilities of SCADA. According to Rantala experimental scenarios for studying intensity of operator
[2], CI businesses have been affected by 13 million cybercrime attacks are offered.
incidents (nearly two-thirds of the total) in U.S.A., with The remaining of this paper is organized as follows. Section
suffering $288 million of financial loss and around 152,200 h II provides an overview of the SCADA system. Section III
of system downtime in 2005. proposes our Petri net models for SCADA insider attacks.
Section IV describes the validation of the models and simulation
One of the major threats of SCADA is when an insider
results. Section V gives the conclusion.
attacker sends legitimate control commands to create
catastrophic damages [3]. An insider attack is a malicious attack II. SCADA SYSTEM
on a computer system or network by an operator with
Modern industrial facilities such as power generation plants,
authorized access control. Insider attack can be deliberately or
potable water systems, wastewater treatment facilities, oil and
inadvertently. Operators or contractors, with extensive internal
gas production and transportation/distribution networks often
knowledge of the SCADA architecture and system policies/
involve components that are geographically distributed. To
procedures, can cause insider attacks. Also an intruder, with
continuously monitor and control the different sections of the
insider role, could use valid SCADA control application to
perform undesirable actions. According to the computer Crime
and Security Survey, insider attacks accounted for 33% of the
plant in order to ensure its appropriate operation leads to the use Historian
Events/
Alarms
SCADA systems. Server (Logs) RTU_1

SCADA refers to the combination of telemetry and data Events/

Alarms/ Events/Alarms
acquisition. Fig. 1 shows Structure of SCADA system. SCADA Commands Commands

includes the collecting of the information via Remote Terminal Communication

Units (RTUs), Programmable Logic Controllers (PLCs) and HMI Server

Intelligent Electronic Devices (IEDs), transferring it back to the Commands

Commands
central site, carrying out any necessary analysis and control and Events/
Alarms Commands Events/
then displaying that information on a number of operator Alarms
RTU_n
screens. Four of the most important part of a SCADA system Operators
are Human Machine Interface (HMI) and Historian servers in
master station, remote terminal (RTU, PLC, IED) in substations
Fig. 1. Structure of SCADA System.
and the communication between them. The HMI is where data
are processed and presented to be viewed and monitored by a security countermeasures such as intrusion detection systems,
human operator [13]. Control room operator using the HMI can cannot detect them.
make supervisory decisions to adjust or override normal RTU B. SCADA INSIDER ATTACKS
controls. SCADA data may also be fed to a Historian, often
There are two kinds of SCADA users [1]: (i) engineers and
built on a commodity Database Management System, to allow
(ii) operators (or dispatcher). An engineer is responsible for
trending and other analytical auditing [14]. SCADA event logs
managing object libraries and user interfaces, setting grid
on historian server provide a complete high-level view on the
topology, normal states and setting parameters of devices,
industrial process that is continuous over time and captures
defining process set points, writing automation scripts, etc. An
information about user activities, system changes in the field as
operator monitors the system status in HMI server, and reacts
well as system status updates [15].
to alarms and some events, so that the process runs correctly.
As most SCADA controls CI, it affects the daily lives of
millions and so, its security is very important. SCADA systems Typical operator actions, include commands for resolving
are vulnerable to both cyber and physical attacks. Cyber alarms, decisions about to increase or decrease power
vulnerabilities includes attacks by worms, spam, virus and more generation, and load transfer by changing grid topology and
others which cause inauspicious degrees of harm to the CIs using backup path, to prevent the creation of new alarms. So,
ranging from the controllable to the severe attacks. On the other although an engineer is a more powerful system user than an
hand, physical vulnerabilities which include electricity operator but the transmission network is controlled by the
blackouts, floods, earthquakes and hurricane which are although operators. Any wrong decision or delay could outage part of
great disasters can be resisted with a strategic protection and neighborhood and in critical condition blackout the total grid.
exploiting the vulnerabilities of a SCADA systems so as to Accordingly, the insider attacks by the operator should be
generate a more efficient protective measures. considered in two parts:
a. When operator is in resolving state of incoming alarms,
A. SCADA Attacks
has two selections:
The following targets can be attacked in SCADA system: (1) Delay attack: No response, or delayed response.
HMI, Data historian, RTUs, communication links, sensors (2) Incorrect or Incomplete attack: Sending incorrect or
threshold values and actuators normal settings [16]. Like any incomplete commands/responses to the alarm, which
industrial control system, SCADA attacks can be divided into make it not resolved perfectly, or become more
two groups: (i) Outsider attacks (ii) Insider attacks. Outsider severe.
attacks are initiated from outside the perimeter, by an In these conditions, there is likely to create cascading
unauthorized or illegitimate user(s), such as hackers, organized failures.
crime groups, or enemy nation states. Outsider attacks are b. When operator tries to create misConfiguration or new
usually opportunistic, deliberate and malicious. alarms, in two ways:
Insider Attacks are one of the most dangerous threats (3) Overload attack: Wrong changing topology and load
organizations face today [11]. Insider attacks occurs when an transfer, which could cause overload or a power
individual or a group within an organization seeks to disrupt failure in a large area.
operations or exploit organizational assets. An insider attack
(4) Outage attack: Opening the output feeders.
occurs when an authorized operator decides to abuse the trust,
and harm the process(es). Therefore, it is difficult to predict and III. PETRI NET MODELING FOR SCADA INSIDER ATTACKS
protect against insider attacks. Although insider attacks may not
occur as frequently as outsider attacks, but they have great A petri network is a graphical and mathematical tool to
impact and higher success rate. So insider attacks seem a much model synchronization process, asynchronous events,
greater risk than outsider attacks [17]. In general, insider attack sequential operations, concurrent operations, conflicts and
scenarios do not include any exploit of a software resources management [18]. Petri net models can be readily
implementation vulnerability (e.g., protocol implementation) used to describe the system behavior by means of causal
and because all the operator commands are legal, traditional relationships between conditions and events in a sequential
way. For that reason, Petri nets are very useful for the analysis
 From RTU Substations
To RTU

Fig. 3. Petri network for resolving alarms.

Incorrect/Incomplete no Response or Delay TABLE I

Response Attack model Atta ck model PLACES FOR THE PN R EPRESENTATION OF RESOLVE ALARMS

misConfiguration Corr ect Response Place Description

Atta ck model model
P1 Alarms in control center (HMI Server)
P2 Acknowledged alarms
Control Center P3 Operator commands/responses
P4 RTU input ports
Fig. 2. Structure of the proposed PN modeling.

of various industrial processes such as production facilities, TABLE II

TRANSITIONS FOR THE PN REPRESENTATION OF RESOLVE ALARMS
modeling of electrical systems, and computational systems.
A CPN model is defined by nine-tuple, CPN = (P, T, A, ∑ , Transient Description
V, C, G, E, M0), where P = {p1, p2, ...pm} represents a set of
T1 Processing alarms by operator
places, T = {t1, t2, ...tn} represents a set of transitions, A ⊆ (P x
T2 The correct commands/responses of operator
T ) ∪ (T x P) is a set of directed arcs, ∑ is a set of non-empty T3 Send to RTU
types (called color sets) , V is a finite set of typed variables such T4 The alarm disappear
that Type[v] ∈ ∑ , C: P→ ∑ is a color set function that assigns
a color set to each place, G is a guard function that assigns a
guard to each transition t such that Type[G(t)] = Boolean, E is an
arc expression function that assigns an arc expression to each arc
a such that Type[E(a)] = C(p), where p is the place connected to
the arc a, M0 is an initialization function that assigns an initial
expression to each place p such that Type[I(p)] = C(p).
Transitions and arcs can also have inscriptions (expressions) to
control the execution of the model. A transition can occur if and
only if, for all input places, sufficient tokens exist that satisfy the Fig. 4. Petri network for misConfiguration attack.
input arc inscriptions, and the transition inscription evaluates to TABLE III
true. There is two types of transitions: immediate transitions are PLACES FOR THE PN R EPRESENTATION OF MISCONFIGURATION ATTACK
represented as black bars, and timed transitions are represented
as empty bars. Place Description Initial Value
Proposed model is based on CPN and representing operator P5 misConfiguration attack exponential(λ)
behavior (commands or attacks) in control center. Fig. 2 shows P6 Out of normal state equipment such as --
Structure of the proposed Petri net modeling. Circuit Breaker

A. Modeling of Resolve Alarms TABLE IV

TRANSITIONS FOR THE PN REPRESENTATION OF MISCONFIGURATION ATTACK
The Petri net for resolving alarms by skill operator is
presented in Fig. 3. As well, place and transition descriptions Transient Description
are in Tables I and II. Making a decision to remove alarms is T5 Sending misConfiguration command
time consuming so T1 and T2 are timed transients. First, alarms T6 Topology attack
are generally acknowledged, then the commands will be issued T7 Equipment parameter setting attack
to resolve them. T8 Overload attack
As any token in place P1 is an alarm, and the correct decision T9 Outage attack
of operator will remove them, so the number of tokens in place
P1 is the number of unresolved alarms. Changing switches from normal state, maybe create outage
attack or overloading attack that cause a new alarm in
B. Modeling of misConfiguration Attack substation. Fig. 4 displays the Petri net model developed for
We can use the Poisson distribution for the number of misConfiguration attack and Tables III and IV describe its
misConfiguration operator attacks with parameter 1⁄λ , and places and transitions.
exponsential distribution with mean value of λ for the time
between them. We can simulate intensity of misConfiguration C. Modeling of Unresolved Alarms Attack
attack by changing of λ parameter. In the Control Center, when alarms were received, the
MisConfiguration attacks include: (i) changing improper operator can make the following methods of attack: (1) no
topology, by bringing out switches from normal state (ii) response (2) delayed response (3) incorrect response (4)
changing improper equipment settings, such as tap changer. incomplete response. Any of these actions could cause to
remain alarm, and a long alarm may lead to a new cascade alarm
 TABLE VII
CONTROL PARAMETERS OF THE MODEL FOR TOTAL SYSTEM

Parameter Description

λ The mean interval between misConfiguration attacks

d The percent of no response or delayed response
attacks
m The percent of incorrect or incomplete response
attacks

TABLE VIII
CONTROL PARAMETERS OF THE ATTACK SCENARIOS
Fig. 5. Petri network for Unresolved Alarms attacks. Cascade
Attack Type λ d m Probability
TABLE V misConfiguration 24 5% 5% 5%
PLACES FOR THE PN R EPRESENTATION OF UNRESOLVED ALARMS ATTACKS Unresolved 8760 80% 80% 5%
Combined 24 60% 60% 5%
Place Description
tokens in place P1 is the number of substation alarms in HMI
P7 d% of alarms- Delayed or no response server. We have counted them using the ‘write in file
P8 m% of remaining alarms- Incorrect or
Incomplete response
monitoring’ tool.
P9 Long alarm or intensive alarm A. misConfiguration Attack Scenario
TABLE VI In this scenario, misConfiguration attack is carried by the
TRANSITIONS FOR THE PN REPRESENTATION UNRESOLVED ALARMS ATTACKS attacker on average once a day. The values of parameters d and
m are assumed 5% as normal human mistake. In addition, since
Transient Description
the creation of a cascade alarm depends on many factors such
T10 Delay attack, holding alarm as the amount of power generation, power plant status, network
T11 Incorrect or Incomplete attack, holding alarm load and etc., and because this topic is beyond the scope of this
and send incorrect command to RTU paper, we assume a fixed low probability (5%) for it. Although
T12 Create a new cascade alarm
this amount could be higher in real terms. The number of alarms
at substation are measured and is shown in Fig. 7. It can be seen
at the same substation or other substations. Fig. 5 displays the that, although the number of alarms are increased but all of them
Petri net model developed for all four attack types. Table V and have been resolved.
Table VI describe all places and transitions that constitute the
Petri net model of Fig 5. B. Unresolved Alarms Attack Scenario
In addition, and in the worst case, the attacker for hide the In this scenario, the values of parameters d and m are
attacks, maybe resolve some alarms. In this situation, we can assumed 80%. Therefore, 80% of alarms would have no
simulate attacker behavior with two parameters: (i) d: is the response or delayed response, and 80% of remaining alarms
percent of attack types (1), (2) and (ii) m: is the percent of attack would have incorrect/incomplete response, and only 20% of
types (3) and (4) for remaining alarms, and so (100- m) is the their remaining alarms would be timely and correctly
percent for resolving remaining alarms. responded. MisConfiguration attack is carried by the attacker
on average once a year as normal human mistake. A fixed low
D. Modeling of Total System
probability is considered for cascading alarms (5%). The
Fig. 6 shows total system model by CPNTOOLS. Place P5 number of alarms at substation are measured and is shown in
has timed colorset with exponential distribution. Only T1, T2 Fig. 8.
are timed transitions and others are immediate transitions. Table
VII shows all three control parameters for total system. Poisson C. Combined Attack Scenario
distribution is used for the number misconfiguration attack. In this scenario, both attacks are carried by the operator. The
number of alarms at substation are measured and is shown in
IV. VALIDATION AND EXPRIMENTAL SCENARIOS Fig. 9. We see that, substation conditions is highly critical.
As a validation of our models, we present some attack V. CONCLUSIONS
scenarios. The control parameters λ, 𝑑, 𝑚 simulate attacker
behavior. By changing them, several types of operator attack This paper has proposed a new CPN modeling for SCADA
can be studied. The values of the control parameters are shown operator behavior in electric power grid. Three model for
in Table VIII. For all scenarios, the models are analyzed by resolving alarms, misconfiguration attack and unresolved
using simulation, state space, and monitoring tools in alarms attacks are presented. CPN is used to analyze insider
CPNTOOLS. We have also used ‘message sequence charts’ to threats that occur in the computer systems, used in CIs. Such
know about step-by-step transitions and places, in addition to threats take place when an attacker manages to gain valid user
credentials and performs actions to alter/disrupt a targeted
notifications, when transitions are executed. The number of
 Fig. 6. Total System of CPN model.

1.2 3.5
Number of Unresoled

Number of Unresolved Alarms

1
3
0.8
Alarms

2.5
0.6
2
0.4
1.5
0.2

0 1
1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 43 45 47 49
0.5
Events
0
73
17
25
33
41
49
57
65

81
89
97
1
9

161
105
113
121
129
137
145
153

169
177
Fig. 7. misConfiguration attack scenario.
Events
industrial process, or when a legitimate user makes an
operational mistake or delay and causes a process failure. Fig. 8. unresolved Alarms attack scenario.
In this paper, we have shown how an unresolved alarm could
create a new cascade alarm. Also we were able to study effects 10
Number of Unresolved Alarms

of various types of operator attacks on the SCADA s by 9

8
changing the control parameters.
7

REFERENCES 6
5
[1] B. Miller, D. C. Rowe, “A Survey of SCADA and Critical Infrastructure 4
Incidents”, Proc. of the 1st Annual conf. on Research in information 3
technology, pp. 51-56, 2012. 2
[2] R. Rantala, “Cybercrime against businesses”, Technical report, U.S. Dept.
1
of Justice, Office of Justice Programs, Bureau of Justice Statistics, Special
0
Report, Sep. 2008.
15
22
29
36
43
50
57
64
71
78
85
92
99
1
8

106
113
120
127
134
141
148
155
162
169
176
183

[3] C. W. Ten, C. C. Liu and M. Govindarasu,“ Vulnerability Assessment of

Cybersecurity for SCADA Systems”, ,” IEEE Trans. Power Systems, vol. Events
23, no. 4, pp. 1836-1846, Nov. 2008.
Fig. 9. Combined attack scenario.
[4] R. Richardson, “Computer crime and security survey”, 15th CSI survey, [12] L. V. Allen, and D. M. Tilbury, “Anomaly Detection Using Model
2010/2011. Generation for Event-Based Systems Without a Preexisting Formal
[5] M. B. Salem, S. Hershkop,S. J. Stolfo, “A Survey of Insider Attack Model”, IEEE Trans. On Systems, Man, and Cybernetircs- Part A:
Detection Research”, Insider Attack and Cyber Security, Advances in Systems and Humans, vol. 42, no. 3, pp. 654-668, 2012.
Information Security, vol. 39, pp. 69-90, Springer US, 2008. [13] R. J. Robles, M. Choi, “Assessment of the Vulnerabilities of SCADA,
[6] A. E. Bouchti, A. Haqiq, “Malicious Insider Attacks Based Colored Petri Control Systems and Critical Infrastructure Systems”, Int. Jour. of Grid
Nets Approach”, Int. Jour. of Engineering & Technology Sciences (IJETS), and Distributed Computing, vol.2, no.2, June 2009.
vol. 1, no. 4, pp. 177-191, 2013. [14] J. Fiaidhi, Y. E. Gelogo, "SCADA Cyber Attacks and Security
[7] T. M. Chen, J. C. S. Aarnoutse, and J. Buford, “Petri Net Modeling of Vulnerabilities: Review", ACN, ASTL, vol. 14, pp. 202-208, 2012,
Cyber-Physical Attacks on Smart Grid”, IEEE Trans. on Smart Grid, vol. SERSC.
2, no. 4, pp.741-749, Dec. 2011. [15] D. Hadziosmanovic, D. Bolzoni, P.H. Hartel, “A Log Mining Approach
[8] M. H. Henry, R. M. Layer, K. Z. Snow, D. R. Zaret, “Evaluating the Risk for Process Monitoring in SCADA”. International Journal of Information
of Cyber Attacks on SCADA Systems via Petri Net Analysis with Security, vol. 11, no. 4, pp. 231-251, 2012.
Application to Hazardous Liquid Loading Operations”, IEEE Conf. on [16] Bonnie Zhu, Shankar Sastry, “SCADA-specific Intrusion Detection/
Technologies for Homeland Security, 2009.
Prevention Systems: A Survey and Taxonomy”, Proc. of the First
[9] A. E. Bouchti, A. Haqiq, “Modeling Cyber-Attack for SCADA Systems Workshop on Secure Control Systems (SCS’10), 2010.
Using CoPNet Approach”, Inter. Conf. on Complex Systems (ICCS), pp.
[17] R. Chinchani, D. Ha, A.Iyer, H.Q. Ngo, and S. Upadhyaya, “Insider Threat
1-6, Nov. 2012.
Assessment: Model, Analysis and Tool”, Network Security, pp. 143-174,
[10] E. Ciancamerla et al., “Overview of modelling techniques and tools for Springer, 2010.
SCADA systems under cyber attacks”, cockpit ci, 2012.
[18] A. Valdes, S. Cheung, B. Dutertre, et al, “Using model-based intrusion
[11] N. Baracaldo, J. Joshi, “An adaptive risk management and access control detection for SCADA networks”, Proceedings of the SCADA Security
framework to mitigate insider threats”, Computer & Security, vol.39, part Scientific Symposium, Jan. 2007.
B, pp. 237-254, Nov. 2013.

View publication stats