Using anomalous event patterns in control systems for tamper detection

Supervisory Control And Data Acquisition (SCADA) systems are used for geographically distributed process control by collecting sensory data that are processed by a central computer. These systems are used in critical domains such as nuclear power plants, public power grids, railway scheduling and ticketing, and others. The malfunctioning of these systems, e.g., if being comprised, could cause severe equipment damage, loss of life, and possibly shutdown of facilities that affect an entire community. As a result, SCADA systems provide nefarious actors, both insiders and outsiders, with great temptation as possible attack targets. In this paper, we present our work for monitoring SCADA systems through the development of a technology that incrementally learns normal behaviors of the system and then continuously watches for the occurrence of abnormal behaviors. Our technology exploits the repeating patterns of normal behavior in SCADA system operation. We describe the system architecture, prototype implementation and results in this paper.