Network Monitoring on Industrial Control Systems Alvaro Cardenas, - PowerPoint PPT Presentation

Network Monitoring on Industrial Control Systems Alvaro Cardenas, PhD. David I Urbina, PhD. candidate

● Introduction of NSM ● Long term goals ● Current Research – ICS T raffjc Analysis – Intrusion Detection ● Some T ools for NSM 1/13/15 2

Network Security Monitoring is the collection, analysis, and escalation of indications and warnings to detect and respond to intrusions. -Informit 1/13/15 3

Network Security Monitoring in ICS 1/13/15 4

Long term goals ● Improve Operational Situational Awareness (OSA). ● Improve Security Situational Awareness (SSA). ● Integrate OSA and SSA into the Control Centers. 1/13/15 5

Integration OSA and SSA in ICS 1/13/15 6

Traffjc Analysis 1/13/15 7

Dissecting Modbus Packets Data Data Link Ethernet 2 / 802.3 IP Data Network TCP Data Transport Data Modbus/TCP Application Modbus 1/13/15 8

Modbus/TCP 1/13/15 9

Intrusion Detection 1/13/15 10

Detection methods: ● Knowledge-based intrusion-detection techniques apply the knowledge accumulated about specifjc attacks and system vulnerabilities. (IT) ● Behavior-based intrusion-detection techniques assume that an intrusion can be detected by observing a deviation from the normal or expected behavior of the system or the users. (ICS) 1/13/15 11

Detection methods: ● Knowledge-based intrusion-detection techniques apply the knowledge accumulated about specifjc attacks and system vulnerabilities. (IT) ● Behavior-based intrusion-detection techniques assume that an intrusion can be detected by observing a deviation from the normal or expected behavior of the system or the users. (ICS) 1/13/15 12

Law Abiding “Behavior” T2 T1 A B A B A B 1/13/15 13

Using models to detect deviations Physical Model 1/13/15 14

Which tools do we use? 1/13/15 15

● Ubuntu-based Linux distribution for NSM. ● Free and open source GNU GPL v2 ● Helps on: – Deep Packet Inspection – Protocol Analysis – Traffjc Analysis – Intrusion Detection and Prevention 1/13/15 16

Deployment scenarios – Standalone – Server-sensor 1/13/15 17

● Core functions – Full packet capture → netsnifg-ng (http://netsnifg-ng.com) – Network-based IDS ● Snort (http://snort.org) ● Suricata (http://suricata-ids.org) ● Bro (http://bro-ids.org) – Host-based IDS ● OSSEC (http://www.ossec.net) – Analysis T ools ● Sguil (http://sguild.sourceforge.net) ● Squert (http://www.squertproject.org/) ● Snorby (https://snorby.org/) ● ELSA (https://code.google.com/p/enterprise-log-search-and-archive/ ) 1/13/15 18

Extensible network analysis framework not restricted to any particular detection approach. ● Free and Open Source Bro 1/13/15 19

Bro features ● Logging framework ● Multiple Traffjc Analyzers for IT and ICS protocols ● Extensible Analysis Architecture ● Domain-specifjc, Turing complete Scripting language 1/13/15 20

Previous related research Analysis of Encrypted Traffjc ● Best Paper Award, "On the Practicality of Detecting Anomalies – with Encrypted T raffjc in AMI", IEEE SmartGridComm, 2014. 1/13/15 21

Thanks! 1/13/15 22