Machine Learning Based Network Vulnerability Analysis of Industrial Internet of Things

I. INTRODUCTION

• SCADA systems provide operators with an HMI to monitor and interact with IIoT devices, while PLCs collect sensor data and command actuators across the control network.The architecture also includes I/O, supervisory-control, and corporate networks.Source: §I · p. 1
• Increased connectivity between ICS and corporate networks, alongside Internet communications, has exposed formerly isolated systems to malicious attacks.The paper identifies protocol security as critical to SCADA availability, safety, and reliability, and presents machine learning as a potential countermeasure.Source: §I · p. 1
• The case study uses a Washington University in St. Louis testbed for real-world SCADA operations, attacks not previously implemented on IIoT systems, and machine-learning IDS analysis.It also studies which features distinguish attack traffic from normal traffic.Source: §I · p. 2
• The paper assesses IIoT vulnerabilities and threat severity, considers machine-learning countermeasures, and reviews machine-learning IDS research for SCADA systems.The vulnerability assessment is intended to help prioritize mitigations.Source: §I · p. 2

II. IIOT COMMUNICATION PROTOCOLS

• The paper examines four popular open SCADA protocols—Modbus, BACnet, DNP3, and MQTT—because their security vulnerabilities affect IIoT network susceptibility.Many SCADA protocols were designed without accounting for cyber risks or security mechanisms.Source: §II · p. 2

A. Modbus

• Modbus lacks confidentiality, authentication, and integrity protections, while flooding attacks can disrupt system availability.Clear-text traffic can be sniffed, and the protocol lacks public/private key management and sufficient traffic security checks.Source: A. Modbus · p. 2, §I · p. 2

B. BACnet

• BACnet supports Ethernet, token-passing, master-slave, and point-to-point communication, with master-slave mode more common in SCADA.BACnet was designed primarily for building automation and control systems and was not designed with security considerations.Source: B. BACnet · p. 2
• BACnet lacks confidentiality and authentication, enabling reconnaissance; denial-of-service attacks can also halt service.Newer standards include DES and AES, but industrial deployments rarely use them because of compatibility concerns and encryption overhead and delay.Source: B. BACnet · p. 2

C. DNP3

• DNP3 devices commonly lack authentication, encryption, and access control despite the protocol’s reliability-oriented design and use across four OSI layers.Communication may be point-to-point, but is mostly master–slave and can include multiple masters and slaves.Source: C. DNP3 · p. 2
• The protocol lacks message authentication, putting data integrity at risk; without encryption, clear-text transmission enables eavesdropping and spoofing, while DoS attacks can disrupt system operation.Its latest version, published by IEEE in 2012, provides secure authentication using IEC 60870-5 digital signatures. PKI complexity and key and certificate management are not yet feasible for simple IIoT devices and can greatly delay system performance.Source: C. DNP3 · pp. 2–3

D. MQTT

• MQTT’s lightweight publish/subscribe design suits remote sensing and control, while brokers filter messages and can serve thousands of clients.Clients act as publishers or subscribers, and MQTT has been increasingly adopted in industrial control systems.Source: D. MQTT · p. 3
• MQTT lacks built-in encryption; TLS/SSL adds client complexity, stolen client identity can expose other clients’ data, and unencrypted credentials travel in clear text.HMAC can support data integrity, but any client holding the shared secret can sign or verify messages.Source: D. MQTT · p. 3

A. Prevalent Attacks

• The threat discussion focuses on CIA traits and AAA controls, excluding accountability as generally administrative, and groups attacks across five compromised aspects.The five classes are integrity, availability, confidentiality, authentication, and authorization; classes can overlap because compromising one aspect may compromise others.Source: §III · p. 3, A. Prevalent Attacks · p. 3

III. PREVALENT NETWORK VULNERABILITIES AND CYBER THREATS

• The paper presents a comprehensive set of prevalent SCADA attacks, defines each by compromised security aspect, explains IIoT performance impacts, assesses risk by damage severity and likelihood, and studies ML-based security solutions.Source: §III · p. 3

1) Integrity / 1.a) Buffer Overflow

• SCADA systems are especially exposed to buffer overflows because ICS operating systems commonly use C and devices may run for years without rebooting, accumulating memory fragmentation.Source: 1.a) Buffer Overflow · p. 3
• Buffer overflows can alter PLC output instructions and sensed data, affecting both SCADA supervisory and field devices.They occur when data exceeds a buffer’s designated size and overwrites other buffers, potentially making the system unreliable or causing it to crash.Source: 1.a) Buffer Overflow · p. 3

1) Integrity / 1.b) Code Injection

• Code injection exploits inadequate validation of user-supplied input to execute malicious commands or inject data, including SQL queries aimed at controlling or compromising a database server.Source: 1.b) Code Injection · pp. 3–4
• SQL injection can expose usernames and passwords or alter data, while command injection can manipulate control commands and disrupt normal operation.Source: 1.b) Code Injection · p. 4

1) Integrity / 1.c) Improper Input Validation

• Improper input validation can let attackers enter wrong values that destabilize systems, and the vulnerability may remain undetected because deterministic systems are not checked regularly.Source: 1.c) Improper Input Validation · p. 4

2) Availability / 2.a) Denial of Service (DoS)

• DoS attackers can use SYN synchronization requests or HTTP GET or POST floods to keep a host or web server busy and unresponsive.The attacks send high volumes of packets or requests to targeted computers such as PLCs and HMIs.Source: 2.a) Denial of Service (DoS) · p. 4
• DoS attacks target availability by preventing legitimate users from accessing resources; congested network links can make ICS monitoring and control highly difficult or impossible.Source: 2.a) Denial of Service (DoS) · p. 4

3.a) Reconnaissance

• Reconnaissance maps SCADA devices, policies, addresses, and hosts to identify vulnerabilities that may later be exploited to disrupt system functionality.Source: 3.a) Reconnaissance · p. 4
• Sniffers can passively inspect SCADA traffic on links between network nodes to reveal network elements and status; the silent attack is very difficult to detect.Examples include links between the I/O network and PLC or between the HMI computer and PLC.Source: 3.a) Reconnaissance · p. 4

4.a) Unauthenticated Access

• Weak SCADA authentication, unchanged or default credentials, brute force, keystroke logging, and phishing can let attackers misuse operator access.The text cites for default credentials and for phishing attacks against ICS operators.Source: 4.a) Unauthenticated Access · p. 4
• The paper classifies merely accessing data without root access as low impact; attacks that obtain greater access, such as directory traversal, fall into more severe categories.This impact classification applies to the unauthenticated-access category.Source: 4.a) Unauthenticated Access · p. 4

4.b) Man-in-the-Middle

• A man-in-the-middle attacker can intercept, alter, discard, or spoof messages between nodes, while valid message syntax prevents rule-based IDS from identifying the attack by format.The text notes that encryption can mostly prevent this attack.Source: 4.b) Man-in-the-Middle · p. 4

5.a) Directory Traversal

• Directory traversal exploits poor input validation or directory-listing controls to access root-restricted files, potentially exposing sensitive information and compromising confidentiality.Proper input validation can prevent this attack.Source: 5.a) Directory Traversal · pp. 4–5

5.b) Backdoor

• A backdoor bypasses authentication and can provide full access to system data, files, and commands; insider installation and vendor support accounts are identified as routes to this highly dangerous vulnerability.Once installed, a backdoor is very difficult to detect; successful attacks can expose all SCADA data.Source: 5.b) Backdoor · p. 5

B. Risk Assessment

• The IIoT risk assessment combines attack likelihood and impact to identify threats that should receive top priority.The authors say the vulnerability ordering reflects their experience and judgment, may vary by application, and is intended as a convenient tool for future studies.Source: B. Risk Assessment · p. 5
• Red marks severe, frequently occurring threats; green marks low-impact, unlikely attacks, while yellow indicates intermediate risk.The matrix classifies likelihood as occasional, likely, or certain and impact as mild, moderate, or critical.Source: B. Risk Assessment · p. 5
• Code injection ranks red because command manipulation can catastrophically affect SCADA and is highly probable; frequent DoS can terminate operations.Reconnaissance may harm confidentiality without necessarily affecting system function.Source: B. Risk Assessment · p. 5

C. ML as a Versatile IIoT Security Tool

• In predefined SCADA networks, conventional IDSs could flag new connections or traffic as unusual flows, but topology upgrades and novel attacks challenge legacy systems.The paper calls for smart IDSs for evolving networks and intelligently planned attacks such as man-in-the-middle attacks.Source: C. ML as a Versatile IIoT Security Tool · p. 5
• ML-based IDSs can learn subtle anomalies and evolving attack patterns, but intrusion detection is difficult when an attacker does not affect network data flow.The paper presents learning and evolution as reasons to favor anomaly-based ML IDSs over increasingly obsolete signature-based systems.Source: C. ML as a Versatile IIoT Security Tool · p. 5

1) Integrity

• For integrity threats, an ML IDS trained on legitimate traffic can identify abnormal command-injection queries and their source, then block the attacker.Learning common system behavior is presented as a way to preserve data trustworthiness against attacks targeting integrity.Source: 1) Integrity · pp. 5–6

2) Availability

• For availability threats, ML can flag unfamiliar or broadcast sources, abnormal nodes, excessive traffic, or halted operations when HMI or PLC flooding makes them unavailable.Unlike a simple network analyzer that requires a human to review logs, an ML IDS automates detection, avoids human error, and has been shown effective for such abnormal behavior.Source: 2) Availability · p. 6

3) Confidentiality

• Eavesdropping that leaves network flow unchanged is very hard to detect, but ML anomaly-based IDSs can flag abnormal snooping behavior once an intruder engages with the network.At that point, the activity extends beyond simple eavesdropping and falls into other attack categories.Source: 3) Confidentiality · p. 6

4) Authentication

• Encryption, strong passwords, and key management are more efficient than detection for countering authentication attacks, though they still improve robustness despite weaknesses.Source: 4) Authentication · p. 6

5) Authorization

• ML can identify abnormal commands, sensor or actuator manipulation, and random traffic by verified users, eventually exposing some zero-day or occasional intruders if sensitivity is high.The IDS learns normal system conditions to reveal abusive commands, unauthorized users, or intruders.Source: 5) Authorization · p. 6
• Higher ML sensitivity raises false positives, but operator-verified alarms are favored because false negatives in critical infrastructure can cost more than false positives.Source: 5) Authorization · p. 6

IV. EXISTING MACHINE LEARNING BASED IDSS

• Because ICS communications and vulnerabilities differ from regular IT networks, the reviewed work emphasizes designing IDSs specifically for SCADA systems.The section surveys ML-based IDS approaches for different SCADA IIoT security vulnerabilities, describing works in detail at first mention and briefly thereafter.Source: §IV · p. 6

A. Integrity

• Beaver et al. tested six ML algorithms on labeled gas-pipeline RTU telemetry with command- and data-injection variants; Ullah and Mahmoud applied J48 filtering followed by Naive Bayes on the same dataset.Source: A. Integrity · p. 6
• Alves et al. used k-means with an OpenPLC SCADA simulation and AES-256 encryption to test code injection, DoS, and interception attacks.Source: A. Integrity · p. 6
• He et al. used a conditional deep belief network on simulated IEEE 118-bus and 300-bus smart grids, comparing it with SVM and ANN for false data injection attacks.Source: A. Integrity · pp. 6–7

B. Availability

• Potluri et al. use SVM and deep belief networks with NSL-KDD, an older dataset not specific to ICS; paper includes DoS attacks in its IDS training dataset.Source: B. Availability · p. 7

C. Confidentiality

• Keliris et al. use reconnaissance and test command injection against a controller, while paper also addresses confidentiality through reconnaissance.Keliris et al. study command injection to manipulate reactor pressure in a simulated Tennessee Eastman chemical-process testbed.Source: C. Confidentiality · p. 7

D. Authentication

• Alves et al. report that unsupervised training detects eavesdropping attacks, and that encryption makes their system resistant to man-in-the-middle attacks.Eigner et al. use KNN-based anomaly detection on a custom conveyor-belt system, focusing on man-in-the-middle intrusions.Source: C. Confidentiality · p. 7, D. Authentication · p. 7

E. Authorization

• The authors report no ML-based SCADA intrusion-detection work on authorization and therefore study backdoor attacks on their SCADA IIoT testbed.Further details are provided in Section V.Source: E. Authorization · p. 7

F. No Specific Attack

• Yasakethu and Jiang compare IDS types without practical analysis; Maglaras et al. train OCSVM on normal traffic, and Mantere et al. select features without attack data.Maglaras et al. use data rate and packet size; Mantere et al. identify flow direction, packet size, protocol, and average rate features.Source: F. No Specific Attack · p. 7
• Zhang et al. use SVM on simulated IEEE 118-bus network traffic, labeling short circuits as faults; no cyber-attacks were conducted.The dataset uses six current, voltage, and power features.Source: F. No Specific Attack · p. 7
• Skripcak and Tanuska describe passive-aggressive online learning for SCADA process forecasting; Siddavatam et al. induce abnormal behavior through operational changes, not attacks.Siddavatam et al. use decision trees and random forests with traffic features including TTL, byte count, word count, packet type, and query reference number.Source: F. No Specific Attack · p. 7

G. Summary

• Table I classifies available ML-based SCADA anomaly-detection approaches by targeted vulnerability, and the authors found no research addressing authorization, which they focus on next.The table summarizes where prior research has concentrated.Source: G. Summary · p. 7, Table I · p. 7

V. OUR CASE STUDY

• The case study logs system transactions to train ML algorithms to detect manipulated commands, and evaluates proposed IDSs using a testbed and conducted cyber-attacks.The section covers testbed implementation, attacks, IDS design, and performance evaluation.Source: §V · p. 8

A. Our Prior Work

• Training datasets with fewer than 1% attack data are a real-world IIoT security challenge because severe imbalance can limit ML intrusion detection.The authors previously studied the effects of imbalanced datasets.Source: A. Our Prior Work · p. 8
• Prior work investigated ML and ANN-based IDSs for confidentiality and availability, including reconnaissance and DoS attacks and.Source: A. Our Prior Work · p. 8
• The improved testbed adds a turbidity alarm and sensor, enabling analog input and investigation of attacks that overwrite the water turbidity level in PLC registers.Source: A. Our Prior Work · p. 8
• Backdoor, command-injection, and SQL-injection attacks are used to study authentication and data-integrity security.Source: A. Our Prior Work · p. 8
• The study uses new metrics to evaluate trained-model performance with greater granularity.Source: A. Our Prior Work · p. 8
• A feature-importance ranking study identifies which features best distinguish attack traffic from normal traffic.Source: A. Our Prior Work · p. 8

B. Our SCADA IDS Testbed Implementation

• The testbed addresses the lack of IIoT-specific security datasets by generating realistic normal and attack traffic on a real-world-like industrial system.Source: B. Our SCADA IDS Testbed Implementation · p. 8
• The water-treatment testbed uses HMI, PLC, logs, three sensors, and four actuators to monitor water level and turbidity over Modbus.Its PLC maintains the water level between predefined bounds and signals turbidity through red, yellow, or green alarm lights.Source: B. Our SCADA IDS Testbed Implementation · p. 8

C. Our Attack Scenarios

• The authors generated SQL- and command-injection attacks alongside backdoor attacks, recording attack and normal traffic with Argus and Wireshark.The attacks used Kali Linux; the study notes that prior work had not focused on machine-learning IDS for SCADA backdoor attacks.Source: C. Our Attack Scenarios · p. 8
• Attack traffic is less than 0.2% of the deliberately imbalanced dataset, whose average data rate is 419 kbit/s and average packet size is 76.75 bytes.Source: C. Our Attack Scenarios · p. 8, Table II · p. 8

1) Backdoor

• The backdoor infects the HMI, opens remote access, and enables file theft and system disruption; the authors transferred about 1GB of sensitive files.They also created directories and removed files, repeating the attack under different system states.Source: 1) Backdoor · p. 9

2) Command Injection

• Command injection targets the PLC: the attacker reads and rewrites registers to alter pump operation and display an incorrect turbidity alarm.Examples include stopping Pump 2 and starting Pump 1, and showing green rather than red when turbidity is high.Source: 2) Command Injection · p. 9

3) SQL Injection

• SQL injection targets HMI and PLC web servers by submitting untrusted data as malicious database queries, which the database executes.The authors ran the attack repeatedly and logged the network traffic.Source: 3) SQL Injection · p. 9

D. Feature Selection

• The study selected 23 network-flow features that change during attacks, since features that remain unchanged cannot help detect intrusions.SrcPkts and DstPkts are mostly periodic during normal operation and random during attacks.Source: D. Feature Selection · p. 9
• Feature importance was measured by permuting one feature at a time and comparing the resulting classification error with the unpermuted error.A higher error increase indicates greater importance; the importance coefficient is the ratio of post-permutation error to standard error.Source: D. Feature Selection · p. 9
• RF was used to calculate feature importance; although five features ranked highest, the threshold analysis indicated that all 23 were needed for training.Figure 4 presents the top-five ranking and normalized importance coefficients; the listed features are Sport, Mean, pLoss, SrcLoss, and Dport.Source: D. Feature Selection · pp. 9–10, Figure 4 · p. 10

E. Machine Learning Techniques

• The IDS is a binary classifier using 23 traffic features to label samples as normal or attack, with 451,372 samples split 80% for training and 20% for testing.The output labels are 0 for normal traffic and 1 for attack traffic.Source: E. Machine Learning Techniques · p. 10
• Seven techniques—SVM, KNN, Naive Bayes, RF, DT, LR, and ANN—were trained and tested on testbed data for performance comparison.The ANN was built with Keras, while the other models used scikit-learn.Source: E. Machine Learning Techniques · p. 10

F. Performance Metrics

• The confusion matrix distinguishes TN and TP correct classifications from FP normal packets labeled as attacks and FN attack packets labeled as normal.The study presents the RF classification results as an example confusion matrix.Source: F. Performance Metrics · p. 10
• Sensitivity is the true positive rate, and the study says it should approach 100% when minimizing false negatives is the priority.Sensitivity and UR are complementary: sensitivity expresses the true positive rate, while UR is the fraction of false-negative attack samples.Source: F. Performance Metrics · p. 10
• The study uses accuracy, FAR, UR, MCC, and sensitivity to assess classification, noting that accuracy alone is insufficient for imbalanced IDS traffic.FAR measures normal traffic misclassified as attacks; UR measures attacks misclassified as normal, while sensitivity is the true positive rate and complements UR.Source: F. Performance Metrics · p. 10

G. Results

• RF had the best accuracy and NB the worst, but accuracy can remain high when algorithms classify all traffic as normal in an imbalanced dataset.Attack samples make up a very small part of the dataset, limiting accuracy's usefulness for evaluating intrusion detection.Source: G. Results · p. 11, Figure 5 · p. 11
• RF had the best undetected-rate performance, while LR was worst—even below the 50% UR expected from random classification with infinitely many packets.UR measures attack traffic misclassified as normal, so dataset imbalance does not affect this metric; the paper considers it more critical than FAR because it reflects attacks not detected.Source: G. Results · p. 11, Figure 7 · p. 11
• RF and NB had the highest sensitivity to abnormal situations, while LR had the lowest.The sensitivity results are shown in Figure 10.Source: G. Results · p. 11, Figure 10 · p. 12

• The case study demonstrates machine learning handling backdoor, command injection, and SQL injection attacks in a near-real-world IIoT testbed, with feature ranking and representative metrics used in evaluation.Source: §VI · p. 12
• The paper examines four common SCADA IIoT protocols and their susceptibilities, assesses prevalent risks and ML countermeasures, and reviews anomaly-detection research to identify remaining security needs.Source: §VI · p. 12
• Future work will jointly design multiple algorithms for better performance and focus on reducing false negatives, which can leave malicious activity undetected with potentially catastrophic consequences.Source: §VI · p. 12