Content uploaded by Muhammad Kamran Asif
Author content
All content in this area was uploaded by Muhammad Kamran Asif on Feb 06, 2015
Content may be subject to copyright.
Intrusion Detection System using Honey Token
based Encrypted Pointers to Mitigate Cyber Threats
for Critical Infrastructure Networks
Muhammad Kamran Asif Yahya Subhi Al-Harthi
Department of Electrical Engineering Department of Electrical Engineering
King Saud University King Saud University
Riyadh, Kingdom of Saudi Arabia Riyadh, Kingdom of Saudi Arabia
mkasif@ksu.edu.sa yalharthi@ksu.edu.sa
Abstract - Recent advancements in cyberspace impose a greater
threat to the security of critical infrastructure than ever before.
The scale of damage that could be done on these infrastructures
by well-planned cyber-attacks is enormous. Most of the research
work done for the security of these critical infrastructures focuses
on conventional security measures. In this paper, we designed an
Intrusion Detection System (IDS) that is based on the novel
approach of Honey Token based Encrypted Pointers to prevent
critical infrastructure networks from cyber-attacks particularly
from zero day cyber threats. These honey tokens inside the frame
will serve as a trap for the attacker. All nodes operating within
the working domain of critical infrastructure network are divided
into four different pools. This division is based according to their
computational power and level of vulnerability. These pools are
provided with different levels of security measures within the
network. IDS use different number of Honey Tokens (HT) per
frame for every different pool. Moreover every pool uses different
types of encryption schemes (AES-128,192,256) etc. We use
critical infrastructure network of 64 nodes for our simulations.
We analyzed the performance of IDS in terms of True Positive
and False Negative Alarms. Finally we test this IDS through
Network Penetration Testing (NPT). This NPT is accomplished by
putting the critical infrastructure network of 64 nodes directly
under the zero day cyber-attacks and then we analyze the
behavior of the IDS under such realistic conditions. The IDS is
designed in such a way that it not only detects the intrusions but
also recovers the entire zero day attack using reverse engineering
approach.
Keywords— Intrusion Detection System; Cyber Threats; Zero Day
Attacks; Critical Infrastructure Networks; Information Security;
Honey Token; Encrypted Pointers; Industrial Networks; Distributed
Sensor Networks; Industrial Communication Protocol; DNP3;
Cyber Security; Cyber Space; SCADA Command and Control
System; Cyber Warfare; Intelligence Infrastructure; Information
Infrastructure.
I. INTRODUCTION
In today’s world we are much more dependent on cyberspace
than ever before. During last two decades internet has grown
exponentially and now it becomes the part of our everyday life.
Our national critical infrastructure networks use cyberspace for
running their operations successfully and efficiently. Electric
power grid networks, water supply systems, nuclear power
plants, air traffic control systems and other critical
infrastructures are continuously facing the threat of cyber-
attacks that are well planned and sometimes backed by other
nation states. So for the protection of these networks which are
very high value national assets require new standards of cyber
security [1]. In last few years we saw major cyber-attacks
which were well planned and specifically designed to target
critical infrastructure sensor networks, most well-known
among these attacks is the “Stuxnet”. It is known as first cyber
weapon which is designed to target Iranian nuclear facilities
and its impact was massive. Other than stuxnet, one of the
biggest challenges is the zero day attacks, those attacks which
can easily bypass the traditional signature based Intrusion
detection systems and if penetrated successfully they will
damage our networks to the huge extent. Today we are facing
enormous challenges in cyber security particularly in critical
infrastructure networks and Cyber Physical Systems (CPS); we
need new approach to improve our existing detection
capabilities [2-4]. Our approach towards IDS is novel and
simple, we use honey token based encrypted pointers for the
detection of zero-day attacks. We embed these honey tokens
inside a frame and an encrypted pointer keeps record of
locations of all these honey tokens. This encrypted pointer is
sent to the destination within the same frame where honey
token packets were embedded earlier. At the receiver side we
extract all the honey tokens from the frame with the help of
encrypted pointer and correlate them with the database of
honey tokens already present at every Remote Terminal Unit
(RTU) for verification of changes made in it.
II. CRITICAL INFRASTRUCTURE NETWORKS
Critical infrastructure is the term mostly used for those
national assets which are very important for operational
stability of economy and society, and without them there is no
concept of running nation state successfully in 21st century. In
today’s modern times all these critical infrastructure operations
run using smart and sophisticated networks called critical
infrastructure networks. There are large numbers of these
critical infrastructures but few most common are as follows.
• Electric Power Grid.
• Oil and Gas Sector.
2014 IEEE International Conference on Systems, Man, and Cybernetics
October 5-8, 2014, San Diego, CA, USA
978-1-4799-3840-7/14/$31.00 ©2014 IEEE 1266
• Nuclear Power Plants.
• Water Supply Systems.
• Air Traffic Control Systems.
• Water Treatment Plants.
• Railway Traffic Systems.
• Industrial Manufacturing.
Critical infrastructure networks commonly have command and
control system for smooth and efficient running of their
operations. Supervisory Control and Data Acquisition
(SCADA) is mostly used for these purposes. It collects data
from all systems using wide range of sensors and then issues
commands from its Master Terminal Station (MTU) for
conducting proper operators [5-9]. The common topology of
critical infrastructure sensor network is shown in Figure 1.
= RTU
= Sensors, Actuators etc
Fig. 1. Critical Infrastructure Network Topology
SCADA system is connected with a network of routing nodes
commonly known as Remote Terminal Unit (RTU), and
sensors are connected with RTU’s. IDS shown in Figure 1 is
Network based Intrusion Detection System (NIDS) and thus
serves the entire critical infrastructure sensor network with its
security services.
III. DNP3 - SYNTHETIC TRAFFIC GENERATOR
Distributed Network Protocol-3 (DNP3) is a set of
communications protocols used between components in
process automation systems. It is the backbone protocol for
SCADA systems and used by almost all the vendors as their
primary protocol for SCADA command and control software
[10]. Our adopted approach for solving the problem is very
simple, we generate DNP3 synthetic traffic, and we designed
DNP3 traffic generator capable of producing millions of DNP3
packets. The frame structure of DNP3 packet is shown in
Figure 2. In the start of the packet we have data link layer
information that includes start bytes, length bytes, control
bytes, destination address, source address and CRC (Cyclic
Redundancy Check) bytes for data link layer, and after this we
have transport layer and application layer headers. In the end
we have data area where we have actual data (payload) and
object header which carries control information associated
with this data area. Object header contains the fields of
function control bytes, internal information bytes, object type
bytes, variation bytes, qualifier bytes, range bytes, data object
bytes, CRC bytes.
Fig. 2. DNP3 Packet Structure
Although DNP3 was designed as reliable protocol but it was
not designed as a secure protocol. It is vulnerable against
attacks which are designed to disrupt control system operations
to disable critical infrastructure networks. So enhanced level of
security must be required in the form of IDS to protect such
important assets as critical infrastructure networks. Honey
tokens used by IDS are normal DNP3 packets generated using
the same synthetic traffic generator. These honey token
packets are similar as compared to real DNP3 packet.
IV. HONEYTOKEN BASED ENCRYPTED POINTERS
Our approach for IDS used a technique called Honey Token
based Encrypted Pointers. Honey tokens are artificial digital
data items planted deliberately into a genuine system resource
in order to detect unauthorized attempts to use or disrupt
original information [11-15]. The honey tokens are
characterized by properties which make them appear as
genuine data items. Honey tokens used by IDS are normal
DNP3 packets planted deliberately into a frame in order to
detect cyber-attack. We generate these honey tokens once at
the start of simulation and make their encrypted database. All
the Remote Terminal Units (RTUs) in the critical
infrastructure network hold a copy of this encrypted honey
token database which they later use for comparison and
correlation of honey tokens at RTU for the detection of any
changes made in the frame by the attacker during transmission
from Master Terminal Unit (MTU) to RTU. The transmission
frame consists of a total of ܰ number of packets; the IDS will
use the length of ܰെͳ packets as process length. In other
words, IDS will embed honey tokens in real traffic at random
locations and make the strings of lengthܰ െ ͳ. The process
length of the frame is as shown in Figure 3.
1 2 3 . . . . . .
N-1
Fig. 3. Process Length for Transmission Frame
The last ܰ௧ packet contains the locations of all these honey
tokens which were embedded earlier in the process length of
the frame by IDS. This last ܰ௧ packet is known as the pointer
of the frame and after encryption it becomes an Encrypted
Pointer (EP). The pointer itself is also a normal DNP3 packet
and all these locations of honey tokens are stored inside the
payload area of this ܰ௧ packet, where all empty space in the
payload area (if any) are filled using zero padding technique. It
is shown in Figure 4 that after inserting the locations of all the
DataLink
Layer
Transport
Layer
Application
Layer Data Area
Object
Header Data
SCADA
MTU
IDS
1267
honey tokens inside the payload area of ܰ௧packet, empty
spaces are filled using zero padding.
Location
HT-1
Location
HT-2 Location
HT-3 Location
HT-4 0 0 0
Zero Padding
Fig. 4. Pointer Structure
V. INTRUSION DETECTION SYSTEM
An Intrusion Detection System (IDS) is a hardware device or
software program/application that is used to monitor network
or individual system activities against malicious attacks or
policy violations and regularly produces logs and reports for
the management stations. Traditionally, IDS were developed
with two major approaches
• Signature based Intrusion Detection Approach.
• Anomaly based Intrusion Detection Approach.
The advantage of signature based intrusion detection approach
is very simple, it is efficient in terms of speed and detection of
known attacks but at the same time it completely fails to detect
zero day attacks or those attacks for which we don’t have
specific signature in IDS database [16-20]. Anomaly based
detection is successful to some extent in detecting novel
attacks but it commonly has a disadvantage that it generates a
large number of false alarms. Moreover in the past IDS were
designed on a generic approach. To the best of our knowledge
very few researchers tried to design intrusion detection
systems that work within specific domains of defined
protocols. We divide critical infrastructure sensor network in
four different categories or pools as shown in Figure 5.
Fig. 5. Segmentation of Pools in Critical Infrastructure Network
This division is based according to the computational power
and level of vulnerability of systems which are working in this
critical infrastructure sensor network.
Fig. 6. IDS working principle at MTU (Master Terminal Unit)
The working principle of IDS at Master Terminal Unit (MTU)
is shown in Figure 6, and working principle of IDS at Remote
Terminal Unit (RTU) is shown in Figure 7.
Match
Mismatch
Fig. 7. IDS working principle at RTU (Remote Terminal Unit)
In Figure 6 the IDS embed honey tokens in the real traffic and
encrypt the pointer, both actions are performed according to
the pool in which destination RTU falls, then the frame is
transmitted towards RTU after attaching encrypted pointer
with it. At receiving end, in Figure 7 the IDS extract encrypted
START
Traffic Generator HT Generator
Transmission
Pool-A
Pool-B Pool-C
Pool-D
Attach
EP
Transmit
Extract EP
Pool-A
Pool-B Pool-C
Pool-D
Extract HT
Scanning No
Attack
Attack
Reverse
Engineering END
1HT/Frame
[AES-128]
2HT/Frame
[AES-192]
3HT/Frame
[AES-192]
4HT/Frame
[AES-256]
Pool - A Pool - B
Pool - C Pool - D
HT Database
1268
pointer from the frame, decrypt it according to the pool in
which RTU falls and after that it extracts all honey tokens from
the frame and correlate them with HT Database which is
already present on RTU. If any mismatch occurs an attack is
detected, the IDS will perform reverse engineering approach
and recover entire signature of zero day attack. Pool-A
contains those systems having greater computational power
and higher vulnerability levels, it uses 4 honey tokens per
frame and use encryption of AES-256 e.g. - Data Centers etc.
whereas Pool-D contain those systems having least
computational power, it uses one honey token per frame and
use encryption of AES-128 e.g. - Tsunami warning system for
open ocean etc. Other two Pools (B and C) contain systems
that fall between above defined categories, Pool-B uses 3
honey tokens per frame and use encryption of AES-192 e.g. -
Oil rigs and Pool-C uses 2 honey tokens per frame and use
encryption of AES-192 e.g.- Remote operating station etc. All
the encryption schemes assigned to the different pools are
basically used for two basic tasks, firstly encryption of pointer
and secondly encryption of honey token database (present at
RTU) for that particular pool. Different encryption schemes
uses different key lengths, larger the key means more is the
required computational power, so key length is directly
proportional to the required computational resources of the
system. All three encryption schemes along with their key
lengths which are used for proposed IDS are mentioned in the
Table 1.
TABLE I. KEY LENGTHS FOR ENCRYPTION SCHEMES
Encryption Type Key Length
AES-256 32 bytes
AES-192 24 bytes
AES-128 16 bytes
VI. SIMULATION RESULTS
In Figure 8 shown result is the output of DNP3 synthetic traffic
generator in matlab, this traffic generator is capable of
generating millions of packets of DNP3 (synthetic traffic). The
start two bytes of every DNP3 packet is always 0564 (defined
standard for DNP3 packet) is clearly highlighted in the Figure
8. In Figure 9 shown result is the output of system alarms.
“True Positive” means when attack occurs and system
successfully detects that attack and “False Negative” means
when attack occurs but system fails to detect that attack. On y-
axis we have the scale of alarm percentage and on x-axis we
have four different pools [A-B-C-D]. Maximum security is
given to Pool-A because these systems possess high
computational power therefore it has very small percentage of
false negative, and from the results in Figure 9 it is shown that
on average false negative alarms are less than 2% for Pool-A.
Fig. 8. DNP3 synthetic traffic generator output
On the other hand least amount of security is provided to pool-
D because these systems are constrained in computation power
and other valuable resources, so the false negative percentage
is almost 12% for Pool-D. From graphical results in Figure 9
which are tabulated in Table 2 shows different pools with their
True Positive (TP) and False Negative (FN) alarm percentages,
all these results are average values. Encryption schemes are
also listed along with different pools in Table 2.
Fig. 9. IDS Performance (Alarm Analysis)
From Figure 9 and Table 2 it is clear that Pool-A has 98% TP
alarms and 2% FN alarms, it uses 4HT/frame with AES-256
encryption scheme. Pool-B has 97% TP alarms and less than
3% FN alarms, it uses 3HT/frame with AES-192 encryption
scheme, Pool-C has 93% TP alarms and 7% FN alarms, it uses
2HT/frame with AES-192 encryption scheme and finally Pool-
1269
D has 88% TP alarms and 12% FN alarms, it uses only one
HT/frame with AES-128 encryption scheme.
TABLE II. IDS ALARM ANALYSIS COMPARISION TABLE
Pool Honeytokens
per Frame
Encryption
Scheme TP Alarm FN
Alarm
A 4 AES-256 98% 2%
B 3 AES-192 97% 3%
C 2 AES-192 93% 7%
D 1 AES-128 88% 12%
VII. NETWORK PENETRATION TESTING (NPT)
In order to test and verify our designed IDS we use NPT.
Alongside our IDS we place another conventional signature
based IDS which contain signature database for some known
attacks for the security of 64 node critical infrastructure test
network and then using matlab we generate zero day attacks
and some known attacks which are already present in the
database of conventional IDS. Finally we launch all these
attacks on test network. Known attacks are immediately
stopped by conventional IDS but all zero day attacks
successfully penetrated in the network. In response our IDS
successfully detected these attacks and recovered them
completely using reverse engineering approach. Snapshot of
IDS scanning process result is shown in Figure 10, where
cyber-attacks are detected by the IDS on node 22, 24 and 32.
Fig. 10. IDS scanning process
VIII. CONCLUSION
In this paper we design an IDS that works on a technique
known as honey token based encrypted pointers against zero
day cyber threats, this IDS is specifically designed for critical
infrastructure sensor networks. We analyzed the performance
of IDS model on security and stability issues. We found that
proposed IDS improved three key issues in existing systems,
the capability of detecting zero day cyber-attacks is much
better than the existing system, the use of encryption in IDS
makes it more difficult for attacks to launch a successful
attack. IDS successfully recover the zero day cyber-attack
signatures using reverse engineering and in this way it assists
conventional signature based IDS in improving their
efficiency.
References
[1] Madjid Merabti, Michael Kennedy, William Hurst, “Critical
Infrastructure Protection: A 21st Century Challenge” International
Conference on Communications and Information Technology.
[2] Ragunathan (Raj) Rajkumar, Insup Lee, Lui Sha, John Stankovic,
“Cyber-Physical Systems: The Next Computing Revolution”
Design Automation Conference 2010.
[3] Jing Lin, Sahra Sedigh and Ann Miller, “A General Framework for
Quantitative Modeling of Dependability in Cyber-Physical
Systems”: A Proposal for Doctoral Research” 33rd Annual IEEE
International Computer Software and Applications Conference.
[4] N. HadjSaid, C. Tranchita, B. Rozel, M. Viziteu, R. Caire,”
Modeling Cyber and Physical Interdependencies– Application in
ICT and Power Grids” IEEE 2009.
[5] Edward Chikuni, Maxwell Dondo, “Investigating the Security of
Electrical Power Systems SCADA” IEEE 2007.
[6] Nai Fovino, A. Carcano, M. Masera “A Secure and Survivable
Architecture for SCADA Systems” pp.34-39, Second International
Conference on Dependability 2009.
[7] Eugene Babeshko, Vyacheslav Kharchenko, Anatoliy Gorbenko
“Applying F(I)MEA-technique for SCADA-based Industrial
Control Systems Dependability Assessment and Ensuring”, Third
International Conference on Dependability of Computer Systems.
[8] Athar Mahboob, Junaid Zubairi “Intrusion Avoidance for SCADA
Security in Industrial Plants”, pp.447-452, IEEE 2010.
[9] “Securing SCADA Infrastructure” Fortnet – Securing SCADA
Infrastructure White Paper.
[10] Gordon Clarke, Deon Reynders, Edwin Wright, “Practical Modern
SCADA Protocols: DNP3, 60870.5 and Related Systems” 2004,
IDC Technologies.
[11] Craig M. McRae, Rayford B. Vaughn, “Phighting the Phisher:
Using Web Bugs and Honeytokens to Investigate the Source of
Phishing Attacks” 2007.
[12] Colon & E. Peldaez, John Bowles “Computer Viruses”, pp. 513-
517, IEEE 1991.
[13] Maya Bercovitch, Meir Renford, Lior Hasson, Asaf Shabtai, Lior
Rokach, Yuval Elovici “HoneyGen: an Automated Honey tokens
Generator” pp:131-136, IEEE 2011.
[14] Jonathan White and Brajendra Panda “Implementing PII
Honeytokens to Mitigate Against the Threat of Malicous
Insiders”,ISI 2009, June 8-11, IEEE 2009.
[15] Anoosha Prathapani, Lakshmi Santhananr and Dharma P. Agrawal
“Intelligent Honeypot Agent for Blackhole Attack Detection in
Wireless Mesh Networks” pp.753-758, IEEE 2009.
[16] Luigi Coppolino, Salvatore D’Antonio, Luigi Romano and
Gianluigi Spagnuolo “An Intrusion Detection System for Critical
Information Infrastructures Using Wireless Sensor Network
Technologies” pp.1-8, IEEE 2010.
[17] Guangcheng Huo , Xiaodong Wang, “DIDS: A Dynamic Model of
Intrusion Detection System in Wireless Sensor Networks”
International Conference on Information and Automation, pp.374-
378, published in 2008.
[18] Muhammad Kamran Asif, Talha A. Khan, Talha A. Taj, Umar
Naeem, Sufyan Yakoob, “Network Intrusion Detection and its
Strategic Importance” IEEE Business Engineering and Industrial
Applications Colloquium, 2013.
[19] Leonard J. LaPadula “Intrusion Detection for Air Force Networks”,
MITRE Technical Report, October 1997.
[20] Daniel C. Hurley, James F.X. Payne, Mary T. Anderson, “Critical
Infrastructure: Electric Power Subcommittee Risk Mitigation in the
Electric Power Sector: Serious Attention Needed”, Armed Forces
Communication and Electronics Association Cyber Committee.
1270
