Advertisement

Multimedia Tools and Applications

, Volume 78, Issue 3, pp 3241–3265 | Cite as

Visualization for internet of things: power system and financial network cases

  • Myungjong Kim
  • Wooyeon Jo
  • Jaehoon Kim
  • Taeshik ShonEmail author
Article

Abstract

National critical infrastructure networks, such as banks and industrial control systems (ICSs), can be serious damaged in the event of a security incident. Therefore, in all these major infrastructures, closed networks are constructed to cut off the attack path. However, owing to the emergence of cloud, Internet of Things (IoT), and artificial intelligence (AI) services, network interconnection is rapidly increasing; thus, many major infrastructure networks can no longer be called closed networks. The ICS, which was previously a strictly closed network, is now usually called Industrial Internet of Things (IIoT) and exhibits many changes, such as smart factories and remote control. Many payment modules use the financial network through IoT or AI-assisted services. In this massive connected environment, the existing closed network defense system may cause difficulties in providing the service. Therefore, there is a need for technology that can continuously monitor the possibility of advanced attacks. In this paper, we define the normal-behavior-based rules from the perspective of network forensics and conduct visualization studies to detect all possible attacks against the control protocol DNP3 (Distributed Network Protocol) and the financial protocol called FIX (Finance Information Exchange). Thus, we detected suspicious network packets on the ICS network and the financial network and identified abnormal behavior that could be the basis of serious attacks.

Keywords

Industrial control system Financial network Visualization Network forensics DNP3 FIX 

Notes

Acknowledgements

- This research was supported by the Ministry of Science and ICT (MSIT), Korea, under the Information Technology Research Center support program IITP-2018-2016-0-00304 supervised by the Institute for Information & Communications Technology Promotion (IITP).

- This work was supported by an IITP grant funded by the Korean government (MSIT) (No. 2018-0-00336, Advanced Manufacturing Process Anomaly Detection to prevent the Smart Factory Operation Failure by Cyber Attacks).

- This work was supported by the Ajou University research fund.

References

  1. 1.
    (2001) Financial information exchange protocol (FIX) Version 4.3Google Scholar
  2. 2.
    (2017) d3 library https://d3js.org/
  3. 3.
  4. 4.
    (2017) Fix protocol south korea community. http://koreafix.egloos.com
  5. 5.
    Abdullah K et al (2005) IDS rainstorm: visualizing IDS alarms 1Google Scholar
  6. 6.
    Abeyrathne KB et al (2009) Visualization tool for network forensics analysis using an intrusion detection system. CYBERVIZ 3Google Scholar
  7. 7.
    Ahmed I et al (2012) SCADA systems: challenges for forensic investigators. Computer 45:44–51CrossRefGoogle Scholar
  8. 8.
    Angelini M, Prigent N, Santucci G (2015) Percival: proactive and reactive attack and response assessment for cyberincidents using visual analytics. Visualization for Cyber Security (VIZSEC), 2015 IEEE Symposium on IEEEGoogle Scholar
  9. 9.
    Arendt D et al (2016) CYBERPETRI at CDX 2016: real-time network situation awareness. Visualization for Cyber Security (VIZSEC), 2016 IEEE Symposium on IEEEGoogle Scholar
  10. 10.
    Blue R et al (2008) Visualizing real-time network resource usage. Visualization for computer security. Springer Berlin Heidelberg 5210: 119–135Google Scholar
  11. 11.
    Clarke G, Reynders D, Wright E (2004) Practical Modern SCADA Protocols; DNP3, 60870.5 and Related Systems. Elsevier 79Google Scholar
  12. 12.
    Digital bond (2016) Download the PCAP files to test the quickdraw signatures, http://www.digitalbond.com/tools/quickdraw/download/
  13. 13.
  14. 14.
    ICS security summit (2016) What’s the dfirence for ICS?. https://www.sans.org/event-downloads/42402/agenda.pdf, P.4
  15. 15.
    ICS-CERT (2016) ICS-CERT Monitor November–December 2015Google Scholar
  16. 16.
    ICS-CERT (2018) MAR-17-352-01 HatMan - Safety System Targeted Malware (Update A)Google Scholar
  17. 17.
    IEEE power and energy society (2012) IEEE standard for electric power systems communications.distributed network protocol (DNP3)Google Scholar
  18. 18.
    NETRESEC (2016) Networkminer, http://www.netresec.com/?page=networkminer
  19. 19.
    Park J-B, Kim H-K, Kim E-J (2014) Design and implementation of the honeycomb structure visualization system for the effective security situational awareness of large-scale networks. J Korea Inst Inform Sec Cryptol 24(6):1197–1213CrossRefGoogle Scholar
  20. 20.
    Promrit N et al (2011) Multi-dimensional visualization for network forensic analysis. Networked Computing (INC), 2011 The 7th international conferenceGoogle Scholar
  21. 21.
    Shahzad A et al (2015) New security development and trends to secure the SCADA sensors automated transmission during critical sessions. Symmetry 7(4):1945–1980MathSciNetCrossRefGoogle Scholar
  22. 22.
    Shiravi H, Shiravi A, Ghorbani AA (2012) A survey of visualization systems for network security. IEEE Trans Vis Comput Graph 18.8:1313–1329CrossRefGoogle Scholar
  23. 23.
    Siadati H, Saket B, Memon N (2016) Detecting Malicious Logins in enterprise networks using visualization. Visualization for Cyber Security (VIZSEC), 2016 IEEE Symposium on IEEEGoogle Scholar
  24. 24.
    US-CERT (2018) VPNFilter Destructive MalwareGoogle Scholar
  25. 25.
    Riel J-P Van, Irwin B (2006) INETVIS, a visual tool for network telescope traffic analysis. 4th Int Conf Comput Graph, Virtual Real, Visual Interact Africa ACM 85–89Google Scholar

Copyright information

© Springer Science+Business Media, LLC, part of Springer Nature 2018

Authors and Affiliations

  • Myungjong Kim
    • 1
  • Wooyeon Jo
    • 1
  • Jaehoon Kim
    • 1
  • Taeshik Shon
    • 1
    Email author
  1. 1.Ajou UniversitySuwonSouth Korea

Personalised recommendations