# SCADA System Testbed for Cybersecurity Research Using Machine Learning Approach
## 2 Background
### Related Works  
Cyber-attacks are continuously evolving and changing behavior to bypass security mechanisms. Thus, the utilization of advanced security mechanisms is essential to identify and prevent new attacks. In this sense, the development of real testbeds advances the research in this area. [PERSON] et al. (2017) describe four datasets to be used for cybersecurity research. The datasets include network traffic, process control, and process measurement features from a set of attacks against testbeds which use Modbus application layer protocol. The authors argue that there are several datasets developed to train and validate IDS associated with traditional information technology systems, but in the SCADA security area there is a lack of availability and access to SCADA network traffic. In our work, a new dataset with new types of attacks was created. So, once our dataset is available, we are providing a resource that could be used by researchers to train, validate, and compare their results with other datasets. In order to investigate the security of the Modbus/TCP protocol, [PERSON] et al. (2018) explored a complex cyber-physical testbed, conceived for the control and monitoring of a water system. The analysis of the experimental results highlights the critical characteristics of the Modbus/TCP as a popular communication protocol in ICS environments. They concluded that by obtaining sufficient knowledge of the system, an attacker is able to change the commands of the actuators or the sensor readings in order to achieve its malicious objectives. Obtaining knowledge of the system is the first step in attacking a system. This attack is also known as a reconnaissance attack. Hence, in our work, our ML models are trained to recognize this kind of attack. In Ref. (2018), [PERSON] et al. describes some practical cyber-attacks using an electricity grid testbed. This testbed consists of a hybrid environment of SCADA assets (e.g., PLCs, HMIs, process control servers) controlling an emulated power grid. The work explains their attacks and discusses some of the challenges faced by an attacker in implementing them. One of the attacks is the reconnaissance network attack. The authors argue that this kind of attack can be used not only to discover devices and types of services but also to perform fingerprinting and discover PLCs behind the gateways. Hence, in our work, advanced reconnaissance attacks were carried out, and ML algorithms were used to detect them. \begin{table}
\begin{tabular}{c c c} \hline
**Reference** & **Range** & **Description** \\ \hline
0 xxxx & 00001-09999 & Read/Write Discrete Outputs or Coils. \\
1 xxxx & 10001-19999 & Read Discrete Inputs. \\
3 xxxx & 30001-39999 & Read Input Registers. \\
4 xxxx & 40001-49999 & Read/Write-Output or Holding Registers. \\ \hline \end{tabular}
\end{table} 
Table 1: Data reference types (2018; 2018). Figure 2: Modbus client/server communication example. In Ref. [10], [PERSON] et al. developed a process-aware supervised learning defense strategy that considers the operational behavior of an ICS to detect attacks in real-time. They used a benchmark chemical process and considered several categories of attack vectors on their hardware controllers. They used their trained SVM model to detect abnormalities in real-time and to distinguish between disturbances and malicious behavior as well. In our work, we used five ML algorithms to identify the abnormal behavior in real-time and evaluated their detection performance. [PERSON] et al. [11] presented a semi-automated method for online security assessment using ML techniques. They outline their experience obtained at the Melentiev Energy Systems Institute, Russia in developing ML-based approaches for detecting potentially dangerous states in power systems. Multiple ML algorithms were trained offline using resampling cross-validation method. Then, the best model among the ML algorithms was selected based on performance and was used online.