Role inference + anomaly detection = situational awareness in bacnet networks

Davide Fauri, Michail Kapsalakis, Daniel Ricardo dos Santos, Elisa Costante, Jerry den Hartog, Sandro Etalle

Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

Abstract

In smart buildings, cyber-physical components (e.g., controllers, sensors, and actuators) communicate with each other using network protocols such as BACnet. Many of these devices are now connected to the Internet, enabling attackers to exploit vulnerabilities on protocols and devices to attack buildings. Situational awareness and intrusion detection are thus critical to provide operators with a clear and dynamic picture of their network, and to allow them to react to threats and attacks. Due to Smart Buildings being relatively dynamic and heterogeneous environments, situational awareness further needs to rapidly adapt to the appearance of new devices, and to provide enough context and information to understand a device’s behavior. In this paper, we propose a novel approach to situational awareness that leverages a combination of learning and knowledge of possible role devices. Specifically, we introduce a role-based situational awareness and intrusion detection system to monitor BACnet building automation networks. The system discovers devices, classifies them according to functional roles and detects deviations from the assigned roles. To validate our approach, we use a simulated dataset generated from a BACnet testbed, as well as a real-world dataset coming from the building network of a Dutch university.

LanguageEnglish
Title of host publicationDetection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Proceedings
EditorsClémentine Maurice, Giorgio Giacinto, Roberto Perdisci, Magnus Almgren, Roberto Perdisci
Place of PublicationCham
PublisherSpringer
Pages461-481
Number of pages21
ISBN (Electronic)978-3-030-22038-9
ISBN (Print)978-3-030-22037-2
DOIs
StatePublished - 6 Jun 2019
Event16th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2019 - Gothenburg, Sweden
Duration: 19 Jun 201920 Jun 2019

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume11543 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

Conference16th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2019
CountrySweden
CityGothenburg
Period19/06/1920/06/19

Fingerprint

Intelligent buildings
Situational Awareness
Anomaly Detection
Intrusion detection
Network protocols
Testbeds
Actuators
Automation
Internet
Intrusion Detection
Controllers
Sensors
Attack
Heterogeneous Environment
Network Protocols
Dynamic Environment
Vulnerability
Leverage
Testbed
Actuator

Cite this

Fauri, D., Kapsalakis, M., dos Santos, D. R., Costante, E., den Hartog, J., & Etalle, S. (2019). Role inference + anomaly detection = situational awareness in bacnet networks. In C. Maurice, G. Giacinto, R. Perdisci, M. Almgren, & R. Perdisci (Eds.), Detection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Proceedings (pp. 461-481). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11543 LNCS). Cham: Springer. DOI: 10.1007/978-3-030-22038-9_22
Fauri, Davide ; Kapsalakis, Michail ; dos Santos, Daniel Ricardo ; Costante, Elisa ; den Hartog, Jerry ; Etalle, Sandro. / Role inference + anomaly detection = situational awareness in bacnet networks. Detection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Proceedings. editor / Clémentine Maurice ; Giorgio Giacinto ; Roberto Perdisci ; Magnus Almgren ; Roberto Perdisci. Cham : Springer, 2019. pp. 461-481 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).
@inproceedings{9ad24fb424b9487fa20c66e25b519a08,
title = "Role inference + anomaly detection = situational awareness in bacnet networks",
abstract = "In smart buildings, cyber-physical components (e.g., controllers, sensors, and actuators) communicate with each other using network protocols such as BACnet. Many of these devices are now connected to the Internet, enabling attackers to exploit vulnerabilities on protocols and devices to attack buildings. Situational awareness and intrusion detection are thus critical to provide operators with a clear and dynamic picture of their network, and to allow them to react to threats and attacks. Due to Smart Buildings being relatively dynamic and heterogeneous environments, situational awareness further needs to rapidly adapt to the appearance of new devices, and to provide enough context and information to understand a device’s behavior. In this paper, we propose a novel approach to situational awareness that leverages a combination of learning and knowledge of possible role devices. Specifically, we introduce a role-based situational awareness and intrusion detection system to monitor BACnet building automation networks. The system discovers devices, classifies them according to functional roles and detects deviations from the assigned roles. To validate our approach, we use a simulated dataset generated from a BACnet testbed, as well as a real-world dataset coming from the building network of a Dutch university.",
author = "Davide Fauri and Michail Kapsalakis and {dos Santos}, {Daniel Ricardo} and Elisa Costante and {den Hartog}, Jerry and Sandro Etalle",
year = "2019",
month = "6",
day = "6",
doi = "10.1007/978-3-030-22038-9_22",
language = "English",
isbn = "978-3-030-22037-2",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
publisher = "Springer",
pages = "461--481",
editor = "Cl{\'e}mentine Maurice and Giorgio Giacinto and Roberto Perdisci and Magnus Almgren and Roberto Perdisci",
booktitle = "Detection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Proceedings",
address = "Germany",

}

Fauri, D, Kapsalakis, M, dos Santos, DR, Costante, E, den Hartog, J & Etalle, S 2019, Role inference + anomaly detection = situational awareness in bacnet networks. in C Maurice, G Giacinto, R Perdisci, M Almgren & R Perdisci (eds), Detection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11543 LNCS, Springer, Cham, pp. 461-481, 16th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2019, Gothenburg, Sweden, 19/06/19. DOI: 10.1007/978-3-030-22038-9_22

Role inference + anomaly detection = situational awareness in bacnet networks. / Fauri, Davide; Kapsalakis, Michail; dos Santos, Daniel Ricardo; Costante, Elisa; den Hartog, Jerry; Etalle, Sandro.

Detection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Proceedings. ed. / Clémentine Maurice; Giorgio Giacinto; Roberto Perdisci; Magnus Almgren; Roberto Perdisci. Cham : Springer, 2019. p. 461-481 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11543 LNCS).

Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

TY - GEN

T1 - Role inference + anomaly detection = situational awareness in bacnet networks

AU - Fauri,Davide

AU - Kapsalakis,Michail

AU - dos Santos,Daniel Ricardo

AU - Costante,Elisa

AU - den Hartog,Jerry

AU - Etalle,Sandro

PY - 2019/6/6

Y1 - 2019/6/6

N2 - In smart buildings, cyber-physical components (e.g., controllers, sensors, and actuators) communicate with each other using network protocols such as BACnet. Many of these devices are now connected to the Internet, enabling attackers to exploit vulnerabilities on protocols and devices to attack buildings. Situational awareness and intrusion detection are thus critical to provide operators with a clear and dynamic picture of their network, and to allow them to react to threats and attacks. Due to Smart Buildings being relatively dynamic and heterogeneous environments, situational awareness further needs to rapidly adapt to the appearance of new devices, and to provide enough context and information to understand a device’s behavior. In this paper, we propose a novel approach to situational awareness that leverages a combination of learning and knowledge of possible role devices. Specifically, we introduce a role-based situational awareness and intrusion detection system to monitor BACnet building automation networks. The system discovers devices, classifies them according to functional roles and detects deviations from the assigned roles. To validate our approach, we use a simulated dataset generated from a BACnet testbed, as well as a real-world dataset coming from the building network of a Dutch university.

AB - In smart buildings, cyber-physical components (e.g., controllers, sensors, and actuators) communicate with each other using network protocols such as BACnet. Many of these devices are now connected to the Internet, enabling attackers to exploit vulnerabilities on protocols and devices to attack buildings. Situational awareness and intrusion detection are thus critical to provide operators with a clear and dynamic picture of their network, and to allow them to react to threats and attacks. Due to Smart Buildings being relatively dynamic and heterogeneous environments, situational awareness further needs to rapidly adapt to the appearance of new devices, and to provide enough context and information to understand a device’s behavior. In this paper, we propose a novel approach to situational awareness that leverages a combination of learning and knowledge of possible role devices. Specifically, we introduce a role-based situational awareness and intrusion detection system to monitor BACnet building automation networks. The system discovers devices, classifies them according to functional roles and detects deviations from the assigned roles. To validate our approach, we use a simulated dataset generated from a BACnet testbed, as well as a real-world dataset coming from the building network of a Dutch university.

UR - http://www.scopus.com/inward/record.url?scp=85067797392&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-22038-9_22

DO - 10.1007/978-3-030-22038-9_22

M3 - Conference contribution

SN - 978-3-030-22037-2

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 461

EP - 481

BT - Detection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Proceedings

PB - Springer

CY - Cham

ER -

Fauri D, Kapsalakis M, dos Santos DR, Costante E, den Hartog J, Etalle S. Role inference + anomaly detection = situational awareness in bacnet networks. In Maurice C, Giacinto G, Perdisci R, Almgren M, Perdisci R, editors, Detection of Intrusions and Malware, and Vulnerability Assessment - 16th International Conference, DIMVA 2019, Proceedings. Cham: Springer. 2019. p. 461-481. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). Available from, DOI: 10.1007/978-3-030-22038-9_22