An Open Framework for Deploying Experimental SCADA Testbed Networks - PowerPoint PPT Presentation

An Open Framework for Deploying Experimental SCADA Testbed Networks Peter Maynard, Kieran McLaughlin, and Sakir Sezer August, 2018 Queen’s University Belfast « CSIT 1 / 14

Outline ▶ Background ▶ High-Level Overview of Framework ▶ Tooling ▶ Ongoing/Future Work 2 / 14

About Myself ▶ Research Assistant, at Queen’s University Belfast, CSIT ▶ PhD 4 years ICS Network-IDS ▶ Research Engineer, at Southampton University, UK ▶ 5G Networks ▶ Computer Science BSc, at Aberystwyth University, UK 3 / 14

Introduction ▶ Framework for creating virtualised SCADA networks ▶ Developed for packet generation for NIDS ▶ Open Source (GPLv3) 4 / 14

Related Work ▶ IDS networking datasets (e.g. KDD’99) ▶ Lack of reproducible ICS/SCADA testbeds ▶ Lack of IEC 60870-5-104 protocol support 5 / 14

Use Cases TestBed ▶ Packet Generation ▶ Attack Simulations ▶ Agent Benchmarking ▶ Extending Limited Hardware 6 / 14

Requirements of a TestBed ▶ Reproducible ▶ Scalability ▶ Domain Fidelity ▶ Process Simulation ▶ Network Emulation ▶ Physical Network ▶ Physical Devices ▶ Multi-Protocol 7 / 14

High-Level Overview of Framework b) Orchestration Stage a) Compilation Stage Deploy 2) CompileSource() SRC 1) CreateBaseImage() Build 4) BootUpVirtualMachine() Operational VM Node Image Provision Profile RTU/HMI/... 3.1) ConfigureBaseImage() 5.1) AsignIP() 5.3) StartServices() 5.2) LoadConfig() 3.3) InstallPackages() Provision Start Configure 3.2) LoadConfig() Configuration Profile 6) Monitor() c) Operation Stage Control VM SSH/Console/Telnet Manage Shutdown Testbed 8 / 14

Tooling 9 / 14

Example Network Key Virtual Physical HMI DHCP IEC104 DHCP Historian DNS OPC UA DNS DB Sockets STP Switch IEC104 IEC104 IEC104 IEC104 RTU RTU RTU RTU RTU Process Simulator 10 / 14

Dataset ▶ Network Reconnaissance ▶ IEC104 Command Injection ▶ 192K Packet Dataset 11 / 14

Ongoing Work ▶ Integration Process Simulators ▶ Implementing additional operation/configuration profiles ▶ Simplify deployment ▶ Expand documentation 12 / 14

Future Work ▶ Testbed Federation ▶ Auto configuration of networking equipment ▶ Amazon Web Services (AWS) and Google Compute Engine ▶ Experimentation with alternative network paradigms 13 / 14

End ▶ www: petermaynard.co.uk ▶ twitter: @pgmaynad ▶ email: p.maynard@qub.ac.uk ▶ git: https://github.com/PMaynard/ ICS-TestBed-Framework ▶ dataset: https://dx.doi.org/10.6084/ m9.figshare.6133457.v1 14 / 14