Structured whitelist generation in SCADA network using PrefixSpan algorithm
Woo-Suk Jung, Jeong-Han Yun, Sin-Kyu Kim, Kyuseok Shim, Myung‐Sup Kim · 2017
SCADA system works in repeated or periodic used of only limited communication devices. Because of this feature, whitelist based security techniques are widely used and access restriction method using whitelist based static ACL is most commonly applied in security field. Static ACL have advantages in security, but their expressiveness is too simple to express communication using dynamic allocated port. In addition, it does not reflect all the communication characteristics of the control device, and the generated static ACL should always be open regardless of the frequent use. We propose a structured ACL that extends the fixed generation sequence information between the communication and communication-specific periodicity to reflect the mechanical and repetitive communication characteristics of the SCADA system in the static ACL. We demonstrate the feasibility of the proposed Structured ACL model in this paper by applying the real SCADA network traffic.