Visualization for internet of things: power system and financial network cases
National critical infrastructure networks, such as banks and industrial control systems (ICSs), can be serious damaged in the event of a security incident. Therefore, in all these major infrastructures, closed networks are constructed to cut off the attack path. However, owing to the emergence of cloud, Internet of Things (IoT), and artificial intelligence (AI) services, network interconnection is rapidly increasing; thus, many major infrastructure networks can no longer be called closed networks. The ICS, which was previously a strictly closed network, is now usually called Industrial Internet of Things (IIoT) and exhibits many changes, such as smart factories and remote control. Many payment modules use the financial network through IoT or AI-assisted services. In this massive connected environment, the existing closed network defense system may cause difficulties in providing the service. Therefore, there is a need for technology that can continuously monitor the possibility of advanced attacks. In this paper, we define the normal-behavior-based rules from the perspective of network forensics and conduct visualization studies to detect all possible attacks against the control protocol DNP3 (Distributed Network Protocol) and the financial protocol called FIX (Finance Information Exchange). Thus, we detected suspicious network packets on the ICS network and the financial network and identified abnormal behavior that could be the basis of serious attacks.
KeywordsIndustrial control system Financial network Visualization Network forensics DNP3 FIX
- This research was supported by the Ministry of Science and ICT (MSIT), Korea, under the Information Technology Research Center support program IITP-2018-2016-0-00304 supervised by the Institute for Information & Communications Technology Promotion (IITP).
- This work was supported by an IITP grant funded by the Korean government (MSIT) (No. 2018-0-00336, Advanced Manufacturing Process Anomaly Detection to prevent the Smart Factory Operation Failure by Cyber Attacks).
- This work was supported by the Ajou University research fund.
- 1.(2001) Financial information exchange protocol (FIX) Version 4.3Google Scholar
- 2.(2017) d3 library https://d3js.org/
- 3.(2017) Fix protocol users. http://www.fixtradingcommunity.org/pg/main/who-uses-fix/fix-version
- 4.(2017) Fix protocol south korea community. http://koreafix.egloos.com
- 5.Abdullah K et al (2005) IDS rainstorm: visualizing IDS alarms 1Google Scholar
- 6.Abeyrathne KB et al (2009) Visualization tool for network forensics analysis using an intrusion detection system. CYBERVIZ 3Google Scholar
- 8.Angelini M, Prigent N, Santucci G (2015) Percival: proactive and reactive attack and response assessment for cyberincidents using visual analytics. Visualization for Cyber Security (VIZSEC), 2015 IEEE Symposium on IEEEGoogle Scholar
- 9.Arendt D et al (2016) CYBERPETRI at CDX 2016: real-time network situation awareness. Visualization for Cyber Security (VIZSEC), 2016 IEEE Symposium on IEEEGoogle Scholar
- 10.Blue R et al (2008) Visualizing real-time network resource usage. Visualization for computer security. Springer Berlin Heidelberg 5210: 119–135Google Scholar
- 11.Clarke G, Reynders D, Wright E (2004) Practical Modern SCADA Protocols; DNP3, 60870.5 and Related Systems. Elsevier 79Google Scholar
- 12.Digital bond (2016) Download the PCAP files to test the quickdraw signatures, http://www.digitalbond.com/tools/quickdraw/download/
- 13.FIREEYE (2016) industrial control systems health check, https://www.fireeye.com/services/mandiant-industrial-control-system-gap-assessment.html
- 14.ICS security summit (2016) What’s the dfirence for ICS?. https://www.sans.org/event-downloads/42402/agenda.pdf, P.4
- 15.ICS-CERT (2016) ICS-CERT Monitor November–December 2015Google Scholar
- 16.ICS-CERT (2018) MAR-17-352-01 HatMan - Safety System Targeted Malware (Update A)Google Scholar
- 17.IEEE power and energy society (2012) IEEE standard for electric power systems communications.distributed network protocol (DNP3)Google Scholar
- 18.NETRESEC (2016) Networkminer, http://www.netresec.com/?page=networkminer
- 20.Promrit N et al (2011) Multi-dimensional visualization for network forensic analysis. Networked Computing (INC), 2011 The 7th international conferenceGoogle Scholar
- 23.Siadati H, Saket B, Memon N (2016) Detecting Malicious Logins in enterprise networks using visualization. Visualization for Cyber Security (VIZSEC), 2016 IEEE Symposium on IEEEGoogle Scholar
- 24.US-CERT (2018) VPNFilter Destructive MalwareGoogle Scholar
- 25.Riel J-P Van, Irwin B (2006) INETVIS, a visual tool for network telescope traffic analysis. 4th Int Conf Comput Graph, Virtual Real, Visual Interact Africa ACM 85–89Google Scholar