Generating Abnormal Industrial Control Network Traffic for Intrusion Detection System Testing

Joo-Yeop Song (1) , Woomyo Lee (2) , Jeong-Han Yun (2) , Hyunjae Park (1) , Sin-Kyu Kim (2) , Young-June Choi (1)

1 Ajou University
2 NSRI - National Security Research Institute [Daejeon]

Industrial control systems are widely used across the critical infrastructure sectors. Anomaly-based intrusion detection is an attractive approach for identifying potential attacks that leverage industrial control systems to target critical infrastructure assets. In order to analyze the performance of an anomaly-based intrusion detection system, extensive testing should be performed by considering variations of specific cyber threat scenarios, including victims, attack timing, traffic volume and transmitted contents. However, due to security concerns and the potential impact on operations, it is very difficult, if not impossible, to collect abnormal network traffic from real-world industrial control systems. This chapter addresses the problem by proposing a method for automatically generating a variety of anomalous test traffic based on cyber threat scenarios related to industrial control systems.

Mots clés: Industrial control systems; anomaly detection; traffic generation

Domaines: Informatique [cs]

Joo-Yeop Song, Woomyo Lee, Jeong-Han Yun, Hyunjae Park, Sin-Kyu Kim, et al.. Generating Abnormal Industrial Control Network Traffic for Intrusion Detection System Testing. 12th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2018, Arlington, VA, United States. pp.265-281, ⟨10.1007/978-3-030-04537-1_14⟩. ⟨hal-02076309⟩