Intrusion Detection of the ICS Protocol EtherCAT

  • Control mechanisms like Industrial Controls Systems (ICS) and its subgroup SCADA (Supervisory Control and Data Acquisition) are a prerequisite to automate industrial processes. While protection of ICS on process management level is relatively straightforward – well known office IT security mechanisms can be used – protection on field bus level is harder to achieve as there are real-time and production requirements like 24x7 to consider. One option to improve security on field bus level is to introduce controls that help to detect and to react on attacks. This paper introduces an initial set of intrusion detection mechanisms for the field bus protocol EtherCAT. To this end existing Ethernet attack vectors including packet injection and man-in-the-middle attacks are tested in an EtherCAT environment, where they could interrupt the EtherCAT network and may even cause physical damage. Based on the signatures of such attacks, a preprocessor and new rule options are defined for the open source intrusion detection system Snort demonstrating the general feasibility of intrusion detection on field bus level.

Export metadata

Additional Services

Share in X Search Google Scholar
Metadaten
Author:Andreas Granat, Hans-Wilhelm Höfken, Marko SchubaORCiD
Document Type:Conference Proceeding
Language:English
Year of Completion:2017
First Page:1
Last Page:5
Note:
International Conference on Computer, Network Security and Communication Engineering (CNSCE 2017), March 26-27, 2017, Bangkok, Thailand
Link:https://www.researchgate.net/publication/315645332_Intrusion_Detection_of_the_ICS_Protocol_EtherCAT
Institutes:FH Aachen / Fachbereich Elektrotechnik und Informationstechnik