B-DT: A Bagged-Decision Tree Detection and Characterization of the IoT-SCADA Network Communication Traffic

Abstract

Accelerated transformation in industrial control systems (ICS) such as Supervisory Control and Data Acquisition (SCADA) from conventional specialized serial-based to Internet protocols (TCP/IP) reliant standard communication protocols such as IEC-60870-5-104 have increased vulnerability to attacks and intrusions. Maintaining the reliability and availability of SCADA systems demands versatile and robust security solutions. This study proposes a monitoring technique to detect and characterize network traffic communication in the IEC-60870-5-104 SCADA network. The proposed anomaly detector employs a Bagged-Decision Tree algorithm (B-DT) for detecting and characterizing IEC-60870-5-104-based SCADA network communication traffic. The proposed B-DT significantly detects and characterizes various network categories and application types. The Matthew correlation coefficient (MCC) validated the predictive performance of the proposed model.