Role inference + anomaly detection = situational awareness in bacnet networks

Davide Fauri, Michail Kapsalakis, Daniel Ricardo dos Santos, Elisa Costante, Jerry den Hartog, Sandro Etalle

Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

1 Downloads (Pure)

Abstract

In smart buildings, cyber-physical components (e.g., controllers, sensors, and actuators) communicate with each other using network protocols such as BACnet. Many of these devices are now connected to the Internet, enabling attackers to exploit vulnerabilities on protocols and devices to attack buildings. Situational awareness and intrusion detection are thus critical to provide operators with a clear and dynamic picture of their network, and to allow them to react to threats and attacks. Due to Smart Buildings being relatively dynamic and heterogeneous environments, situational awareness further needs to rapidly adapt to the appearance of new devices, and to provide enough context and information to understand a device’s behavior. In this paper, we propose a novel approach to situational awareness that leverages a combination of learning and knowledge of possible role devices. Specifically, we introduce a role-based situational awareness and intrusion detection system to monitor BACnet building automation networks. The system discovers devices, classifies them according to functional roles and detects deviations from the assigned roles. To validate our approach, we use a simulated dataset generated from a BACnet testbed, as well as a real-world dataset coming from the building network of a Dutch university.

Original languageEnglish
Title of host publicationDetection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Proceedings
EditorsClémentine Maurice, Giorgio Giacinto, Roberto Perdisci, Magnus Almgren
Place of PublicationCham
PublisherSpringer
Pages461-481
Number of pages21
ISBN (Electronic)978-3-030-22038-9
ISBN (Print)978-3-030-22037-2
DOIs
Publication statusPublished - 6 Jun 2019
Event16th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2019 - Gothenburg, Sweden
Duration: 19 Jun 201920 Jun 2019

Publication series

NameLecture Notes in Computer Science
Volume11543
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

Conference16th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2019
CountrySweden
CityGothenburg
Period19/06/1920/06/19

    Fingerprint

Cite this

Fauri, D., Kapsalakis, M., dos Santos, D. R., Costante, E., den Hartog, J., & Etalle, S. (2019). Role inference + anomaly detection = situational awareness in bacnet networks. In C. Maurice, G. Giacinto, R. Perdisci, & M. Almgren (Eds.), Detection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Proceedings (pp. 461-481). (Lecture Notes in Computer Science; Vol. 11543). Cham: Springer. https://doi.org/10.1007/978-3-030-22038-9_22