Detecting Anomalous DNP3 Commands Using Temporal Analysis

For decades, the cyber-security and protection of Supervisory Control and Data Acquisition (SCADA) have been a subject of active research due to the catastrophic consequences that can result from the intrusion or compromise of these systems. Industrial processes of physical infrastructures are monitored and controlled by SCADA from a central control station. It is extensively employed in critical infrastructure sectors, such as the production and distribution of oil, gas, and electricity. The operation of critical national infrastructure could be substantially disrupted by the breach of data integrity in the SCADA systems through cyber-attacks, specifically the unauthorized manipulation of sensors or control signals. This study focuses on improving SCADA security system by addressing vulnerabilities in the widely used DNP3 protocol, which is a prime target for cyber-attacks. To tackle this, we developed an intrusion detection system that monitors DNP3 command requests through temporal analysis. By tracking function codes and how often requests occur, the system can identify suspicious activity. Our evaluation, based on Cold Restart request data, showed that the system achieved an 81.8% detection rate with no false alarms, proving its reliability. This approach is an important step in strengthening SCADA security, helping protect critical infrastructure from evolving cyber threats.