Unsri Researchers Successfully Identify Cyberattack Patterns and Detection Methods in SCADA Networks

Unsri researcher Dr. M. Agus Syamsul Arifin stated in his doctoral presentation at the Faculty of Engineering, Sriwijaya University, that SCADA is designed for closed networks with specialized protocols that are isolated from the internet using firewalls.

However, modern SCADA systems are required to connect to one or more other network protocols to facilitate access to the SCADA system from heterogeneous networks, thereby increasing the vulnerability of the SCADA system.

“This phenomenon is worth studying because few researchers have conducted a comprehensive analysis of security in SCADA networks,” he said on Monday (July 31, 2023).

He also explained that the objective of this research is to design an ideal IDS for SCADA networks using a machine learning approach focused on the IEC 60870-5-104 protocol, specifically targeting the following cyberattacks: port scans, brute-force attacks, man-in-the-middle (MiTM) attacks, ping flood (ICMP flood), SYN flood, XMAS flood, and IEC104 flood.

“The last four attacks are of the DOS (Denial of Service) type,” he explained.

The algorithms used to build the IDS model for detecting attacks on the dataset by P. Maynard et al. were KNN, decision tree, random forest, and SVM with polynomial, linear, and radial basis function kernels.

The highest accuracy achieved by the IDS model when using this dataset was 98.84 percent with the decision tree algorithm. Meanwhile, the highest accuracy when building an IDS model using the Comnets SCADA IEC 104 dataset was 99.05 percent when combined with the random undersampling method.

“In addition to identifying the optimal IDS model for SCADA networks using the IEC 104 protocol and the IEC 104 SCADA IDS dataset, this research also successfully identified attack patterns occurring in SCADA networks that use the IEC 104 protocol,” explained Agus.

Over the course of four years of research at the COMNETS (Communication Network, Enterprise, and Information Security) Research Lab at Sriwijaya University under the supervision of Prof. Deris Stiawan, Ph.D., and in collaboration with researchers at Universiti Teknologi Malaysia and Albaha University in Saudi Arabia.

The research has resulted in six scientific papers published in several reputable international journals and conferences, as well as national grants over the past two years. The research results are available in the https://www.scopus.com/authid/detail.uri?authorId=57220893571 database and have been cited by researchers from other countries.