GRASSMARLIN-based Metadata Extraction of Cyber-Physical Systems Intrusion Detection in CyberSCADA Networks
John Edet Efiong, Bodunde Odunola Akinyemi, Emmanuel Ajayi Olajubu, Ganiu A. Aderounmu · 2022
Cyber-Physical Systems such as those in the SCADA architecture and the entire industrial control system networks have now become essential components of the cyberspace due to their integration with modern IT networks. Cyber attackers have taken advantage of these vulnerable critical assets that have suddenly found themselves in an unprepared situation enabled by the Internet of Things Paradigm. Intrusions into the new CyberSCADA networks seem to go unabated as the proprietary communication protocols in these systems lack security mechanisms to help intrusion detection and analysis. In addition, existing network analyzers are weak in identifying granular details from traffic in these legacy networks that could help track, detect and investigate intrusions. This study performed a passive fingerprinting exercise on captured network data using Grassmarlin and identified useful metadata of critical network devices. The results demonstrate that fingerprints, metadata and critical assets' inventory on Grassmarlin would help industry-based cybersecurity personnel improve intrusion detections on CyberSCADA networks.