Modelbased Intrusion Detection for SCADA Networks Steven Cheung

Model-based Intrusion Detection for SCADA Networks Steven Cheung, Bruno Dutertre, Martin Fong, Ulf Lindqvist, Keith Skinner, Alfonso Valdes (valdes@csl. sri. com) This work was produced in part with support from the Institute for Information Infrastructure Protection (I 3 P) research program. The I 3 P is managed by Dartmouth College, and supported under Award number 2003 -TK-TX-0003 from the U. S. Department of Homeland Security, Science and Technology Directorate. Points of view in this document are those of the author(s) and do not necessarily represent the official position of the U. S. Department of Homeland Security, the Science and Technology Directorate, the I 3 P, or Dartmouth College.

Presentation Outline n Background n SRI Overview n The I 3 P SCADA Project n Intrusion detection approaches n IDS in PCS n Defense enabled architecture n Model based detection n Detect deviations from Modbus spec n Detect invalid communication patterns n Detect changes in service usage patterns n Detector based on formal model n Conclusion

Who we are SRI is a world-leading independent R&D organization SRI headquarters, Menlo Park, CA n Founded by Stanford University in 1946 n A nonprofit corporation n Independent in 1970; changed name from Stanford Research Institute to SRI International in 1977 n Sarnoff Corporation acquired in 1987 (formerly RCA Laboratories) n 2, 000 staff members combined n 800 with advanced degrees n More than 15 offices worldwide n Consolidated 2005 revenue: $390 million Sarnoff Corporation, Princeton, NJ • Sarnoff India • SRI Taiwan SRI – State College, PA SRI – Tokyo, Japan SRI – Washington, D. C.

What we do We create solutions that address your needs n Customer-sponsored R&D From discovery, study, and evaluation to custom solutions on demand n Licenses Innovative technologies ready for use n Ventures Spin-off companies to capitalize on new opportunities n Partnership programs Value creation programs to maximize your success

Our focus areas Multidisciplinary teams leverage developments from SRI’s core technology and research areas Advanced Materials, Microsystems, and Nanotechnology Engineering and Systems Health, Education, and Economic Policy SRI’s Value Creation Process™ Biotechnology Information Technology

Computing SRI invented the foundations of personal computing 1964– 1968: SRI’s Doug Engelbart and team invented the computer mouse and demonstrated the foundations of personal computing. Today: SRI leads development of CALO, the Cognitive Assistant that Learns and Organizes, to revolutionize how computers support decision makers. President Bill Clinton presents Doug Engelbart with the 2000 National Medal of Technology

Intelligent robotics SRI has pioneered robotics for 40 years Today: SRI’s Centibots, one of the first and largest teams of mobile coordinated robots, can explore, map, and survey unknown environments. Elected to the Robot Hall of Fame in 2004 1966– 1972: SRI’s Shakey was the first mobile robot capable of reasoning about its actions.

Internet and networks SRI was there “before the beginning”. com. gov. org 1969: SRI received (from UCLA) the first logon to the ARPANET, predecessor of the Internet. 1970– 1992: SRI ran the Network Information Center (NIC), the domain name registration clearinghouse for all Internet computer hosts connecting to the ARPANET and Internet. SRI assigned all. com, . org, and. gov domain names. 1987: SRI’s pioneering network intrusion detection technology protects against malicious attacks. Today: SRI administers the Cyber Security R&D Center for the Department of Homeland Security. The Center develops security technology for protection of the U. S. cyber infrastructure through partnerships between government and private industry, the venture capital community, and the research community.

The Critical Infrastructure of the United States

What is the I 3 P? n The Institute for Information Infrastructure Protection, funded by Congress, managed by Dartmouth College with oversight from DHS – www. thei 3 p. org n Established in 2001 to identify and address critical research problems facing our nation’s information infrastructure n Consortium of over 25 universities, non-profit research institutions, and federal labs

What is this Research Project? n Two-year applied research effort to improve cyber security for control systems/SCADA n Help industry better manage risk by providing risk characterization n developing and demonstrating new cyber security tools and technologies n enhancing sustainable security practices for control systems n

Why is this Project Important? Control systems are critically important to the safe and efficient operation of infrastructure systems but are vulnerable to cyber attacks: n n Control systems security problems and remediation approaches are different from IT Effects of cyber attacks on operations and interdependent infrastructures not well understood

Project Goals n Demonstrated improved cyber security in the oil and gas infrastructure sector n n New research findings New technologies n Significantly increased awareness of n n Security challenges and solutions The capabilities of the I 3 P and its members

Intrusion Detection Approaches n Signature: Match traffic to a known pattern of misuse n Stateless: String matching, single packet n Stateful: Varying degrees of protocol and session reconstruction n Good systems are very specific and accurate n Typically does not generalize to new attacks n Anomaly: Alert when something “extremely unusual” is observed n n n Learning based, sometimes statistical profiling In practice, not used much because of false alarms Learning systems are also subject to concept drift

Intrusion Detection Approaches (2) n Probabilistic (Statistical, Bayes): A middle ground, with probabilistically encoded models of misuse n Some potential to generalize n Specification based (some group this with anomaly detection): Alert when observed behavior is outside of a specification n High potential for generalization and leverage against new attacks

Our Hypothesis n By comparison to enterprise systems, control systems exhibit comparatively constrained behavior: n n Fixed topology Regular communication patterns Limited number of protocols Simpler protocols n As such, specification- and model-based IDS approaches may be more feasible n Such an approach nicely complements a signature system n Benefits are a compact, inherently generalized knowledge base and potential to detect zero day attacks

Pattern Anomaly Detection Library patterns New Obs P 1 DE A D n. Binary patterns n. Fixed X X P 2 length: TCP flags n. Variable length n. Patterns of categorical-valued features n(Counts of) system calls n. Ports n. Observation matches P 1 in D and X, P 2 in A and D, but X has a low hit count • => P 2 is a better match • Observation is assigned the label of P 2 • Depending on whether P 2 is rare or previously labeled malicious, generate an alert • New P 2 has a little “X” A D New P 2 A D X

Bayes Net Algorithms n Describe the world in terms of conditional probabilities n Model observables as nodes in a directed graph n Children get p (prior) messages from parents n Parents get l (likelihood) messages from children At leaf nodes, l messages correspond to observations n Belief state is updated as new evidence is observed n p(A) l(A) A l(D) p(B) l(B) p(C) B l(C) p(D) C p(X) D l(Y) l(X) p(Y) X Y This diagram illustrates message propagation in a tree fragment

Learning, adaptation n Bayes models have a network structure and node parameters Conditional probability tables, or CPT n CPT(i, j)=P(child state = j | parent state = i) n We did not try to learn structure n CPT’s can be learned off-line or adaptively n For real world data, no ground truth. n We observed “hypothesis capture” on very long runs n e. Bayes has optional capability to generate new hypotheses if no existing ones fit n Stability of learning and hypothesis generation are still research issues for us n

Transition and Update n New sessions start with a default prior over normal and attack hypotheses n Inference results in new belief n “In progress” alerts may be generated n This passes through a temporal transition model n Tends to decay back to normal n But once a session is sufficiently suspicious, it will be reported n New inference updates belief New Observations Mail FTP DICT Transition Function Bayes Inference Model Mail FTP DICT

Approaches Provide Complementary Protection Approach Basis Attacks Detected Generalization Misuse Signature, Stateful analysis Known No Anomaly Learned models of normal Must appear anomalous (not all do, FP) Yes Probabilistic Model learning Match patterns of misuse Some Spec based Analysis of protocol spec Attacks must violate spec (not all do) Yes

Models and Detection Approaches n Signature and probabilistic IDS model misuse n Anomaly approach empirically models “normal” system usage and behavior n Specification-based approach models what is allowable under the protocol specification n Also models “normal”, but in a different sense from what is typically meant in anomaly detection n Drawbacks of specification-based models: n For general enterprise systems, constructing models is expensive and difficult (system complexity, complexity of user activity) n Inaccurate models can lead to false alarms and/or missed detections

IDS In PCS n Barrier defenses (switches, firewalls, network segmentation) are essential, but n An orthogonal view is essential to detect when these have been bypassed or penetrated n One detection approach may not alert on a critical exploit n Correlation of related events is essential to provide the operator coherent situational awareness

EMERALD IDS for PCS n Multi-algorithm IDS appliance Pattern Anomaly n Bayes analysis of TCP headers n Stateful protocol e. Xperts n Complemented by custom ruleset SNORT n Alerts (potentially from multiple IDS appliances) forwarded to correlation framework n PCS Enhancements n Digital Bond PCS rule set n Model Based Detection n

Models for Characterizing Acceptable Behavior n Protocol level: based on MODBUS protocol spec, for single field and dependent fields n Network access patterns, based on analysis of topology configuration n Service usage patterns, based on learned valid MODBUS function codes for monitored devices

Protocol Model: Individual fields n MODBUS function codes are one byte n 256 possible values, but n MSB is used by servers to indicate exception n 0 is not valid, so valid range in 1 -127 n Range is partitioned into public, user-defined, and reserved n With no further knowledge, can construct a “weak specification” n Many actual devices support a much more limited set of codes n Permits definition of a stronger, more tailored specification

Protocol Model: Dependent Fields n Encode acceptable values of a field given the value of another field Example dependent fields include length, subfunction codes, and arguments n For example, “read coils” function implies the length field is 6 n For other function codes, length varies but a range can be specified n n Specifications for multiple ADUs: future work

Detecting Unusual Communication Patterns n Specification of network access policies n Comm between Admin LAN and PCS LAN is restricted to that between Admin historian and PCS historian n PCS Master may communicate with Modbus PLC using Modbus-TCP n PCS historian may communicate with PCS Master n Domain controller may provide services to other hosts in the PCS LAN n Detection of exceptions is via SNORT rules n More complex networks (more devices) can be accommodated via IP address assignment with appropriate subnet masks

Detecting Changes in Server/Service Availability n EMERALD Bayes component includes TCP service monitoring New service discovery (suspicious in a “stable” system) n Service up/down/distress n Modifies probability models and makes the component more accurate n EMERALD SCADA includes analogous capability for MODBUS function codes n Alerts when a device responds to a new function code (MODBUS service discovery) n Alerts when a function code previously considered valid for a device results in error replies n

Complete Formal Model in PVS: Prototype Verification System n Expressive specification language (higher order logic) + powerful theorem prover n Other tools available in PVS: n Model checker n Compiler and execution environment for a subset of the PVS language n Model-based IDS in PVS: n Full specification of Modbus protocol in PVS n Customizable to the actual system (e. g. , which functions/addresses are used). More complete and precise than SNORT-based model

From PVS model to IDS n PVS Model: n Specifies correct Modbus requests and valid responses to requests n Defined by two PVS predicates with signature acceptable_request: [packet bool] valid_response: [request, packet bool] n These predicates are in the executable fragment of the PVS language n IDS: use the model online n Compile the predicates into executable code (uses the PVS compilation/evaluation tools) n Check for violations are runtime: intercept requests/responses and evaluate the predicates.

Testbed Architecture PCS-Enabled NIDS/Mcorr Appliance Alerts and Diagnostics • SHARP (PNNL) • Sec. SS (Tulsa) • APT (UIUC)

Experimental Scenario (1) n Internet attacker achieves privileged access to the corporate n n network (Admin PC). The attacker downloads hack tools to the compromised corporate network host, and sets up a tftp server for his tools. The attacker scans the network (Admin LAN) and discovers the Admin Historian on the corporate network. The attacker achieves elevated access to the Admin Historian, and learns of a data relationship to a PCS Historian on the other side of a firewall. The Admin Historian is subsequently pushed off the network, and the Admin PC assumes its IP. The attacker scans the PCS Historian from the Admin PC.

Scenario (2) n The attacker discovers a vulnerable authentication service on n n the PCS Historian host and visible because of a bad firewall configuration on the PCS FW. It is subsequently exploited to connect with system privilege to the PCS Historian. The attacker downloads a "rogue master" and other tools to the compromised PCS Historian via tftp from the Admin PC. The PCS Historian now serves as the launching point for subsequent attacks, directed from the Admin PC. The attacker scans the PCS network (PCS LAN) and discovers a vulnerable PCS Master box. The attacker launches an attack to take down the PCS Master. The attacker initiates a Modbus device scan on the PCS LAN and discovers the PLC. Subsequently, a Modbus command is sent to close a contact to the PLC; a light/indicator illuminates

Detections n Scans: Bayes sensor, unusual comms n Aggregation presents thousands of probes as single alert n Compromise exploits (UPNP): SNORT Bleeding Edge n tftp: Unusual Comms n MODBUS Exploits: New modbus services, spec based detection, Digital Bond set

Alert Summary

Summary n Barrier protections are essential in PCS n DMZ n Switches, firewalls, VPN n IDS is an important orthogonal defense n Model based approach using protocol specs is a feasible complement to signature IDS in control systems n Multi-component, multi-approach detection provides complementary views of an attack n Alert correlation presents actionable situational awareness picture

I 3 P Houston Workshop will provide: n Overview of threats to PCS n Demonstration of vulnerabilities in PCS n Technology demonstration n Training in risk management, security tools, and mitigation strategies n Opportunity for dialog with industry leaders n Sheraton Brookhollow Houston n February 15 -16 n www. thei 3 p. org

Backup

Similarity Function • Generalizes N(Intersection)/N(Union) • “Intersection” is the sum of the min probabilities where the patterns intersect • “Union” is the maximal probability where either pattern is non-zero

Picking the Winner • Library patterns “compete” for new pattern • Winner is most similar as long as similarity is over a set threshold • Winner is slightly modified to include a little of the new pattern.

Determining “Rare” • If large number of patterns is learned, many may be rare • Alert on tail probability • Technique does not work for large number of patterns, but tail prob approach does no harm