Mitigating Resource Depletion and Message Sequencing Attacks in SCADA Systems

Electric grid networks bring measurement data to a control center for making safety critical decisions. These messages are sent using application layer protocols like Modbus and IEC-104, which operate over TCP/IP. Such communications are susceptible to different cyber attacks. In the direction of safeguarding grids, our contributions in this paper are threefold. First, we study two types of attacks known as malformed and message sequencing attacks. In the malformed message attack, an adversary injects a large number of malformed messages and have it sent to the control center to overwhelm it and depleting its computational resources. In the sequencing attacks a series of messages are sent to generate an attack. These messages if accepted by the control center can impact safety of the grid as it can lead to improper assessment of grid network state. Second, we describe a method to detect variants of malformed messages using first order logic statements. Third, we propose a method to filter the messages belonging to malformed and sequencing attacks using the Extended Berkeley Packet Filter. This is realized by implementing logical statements and screening the messages over a window period to show that such a filtering is effective and robust against attack variants and intensity.