Source-linked AI summary
Architecture and Security of SCADA Systems: A Review
Geeta Yadav, Kolin Paul
TL;DR
Modern SCADA systems support critical infrastructure but are increasingly exposed to cyber attacks as they become geographically distributed and Internet-connected. This paper reviews SCADA architectures, attacks, intrusion detection, testbeds, and IoT-Cloud systems, concluding that IDSs and testbeds still require substantial improvement.
Problem
Internet-connected, geographically distributed SCADA systems face increasing and increasingly sophisticated cyber threats, while practical security research is constrained by limited empirical operational data and expensive testbeds.
Method
The paper provides a structured, multidimensional review of SCADA architectures, communication protocols, attacks, intrusion detection techniques, testbeds, and IoT-Cloud-based systems.
Results
The review finds substantial scope to improve IDS placement, validation, attack coverage, latency, and false-positive rates, alongside testbed cost, scalability, and fidelity.
Takeaways & Limitations
Closing SCADA security gaps requires continued improvement of intrusion detection and testbed solutions, particularly in cost, scalability, validation, coverage, latency, and fidelity.
Takeaways & Limitations
No proper database currently covers all SCADA security incidents, while existing datasets are outdated, insufficiently SCADA-specific, or not regularly updated.
Abstract
from arXiv · showhide
Pipeline bursting, production lines shut down, frenzy traffic, trains confrontation, nuclear reactor shut down, disrupted electric supply, interrupted oxygen supply in ICU - these catastrophic events could result because of an erroneous SCADA system/ Industrial Control System(ICS). SCADA systems have become an essential part of automated control and monitoring of many of the Critical Infrastructures (CI). Modern SCADA systems have evolved from standalone systems into sophisticated complex, open systems, connected to the Internet. This geographically distributed modern SCADA system is vulnerable to threats and cyber attacks. In this paper, we first review the SCADA system architectures that have been proposed/implemented followed by attacks on such systems to understand and highlight the evolving security needs for SCADA systems. A short investigation of the current state of intrusion detection techniques in SCADA systems is done , followed by a brief study of testbeds for SCADA systems. The cloud and Internet of things (IoT) based SCADA systems are studied by analysing the architecture of modern SCADA systems. This review paper ends by highlighting the critical research problems that need to be resolved to close the gaps in the security of SCADA systems.
1 Introduction
SCADA systems support essential critical-infrastructure operations, but their evolution toward interconnected and standardized architectures has increased exposure to sophisticated cyber attacks. This review links architecture, protocols, vulnerabilities, attacks, and security measures to address these risks.
- SCADA systems support essential services across sectors including healthcare, nuclear energy, transportation, energy, water, and agriculture.
- Originally standalone and dependent on air-gapped networks and proprietary protocols, SCADA systems have become geographically distributed and more vulnerable to remote attackers.
- Modernization, standardized protocols, and growing interconnectivity have increased cyber attacks whose consequences can include financial loss, environmental harm, and loss of human life.
- The review interconnects SCADA architecture, communication protocols, vulnerabilities, attacks, intrusion detection, and testbeds to provide a holistic security perspective.
- The authors select and classify relevant literature from conferences, journals, and major scholarly databases before correlating studies across SCADA security dimensions.
2 Taxonomy
The paper organizes SCADA security research into a taxonomy covering architectures, attacks, intrusion detection systems, and testbeds. This classification connects security mechanisms with attack types, required data, and validation environments.
- SCADA architecture: The taxonomy classifies SCADA architectures into monolithic, distributed, networked, and IoT-based fourth-generation systems.
- Attack analysis: SCADA attacks are analyzed by country or industry, target component, impact, and attack type.
- Intrusion detection: Intrusion detection systems are categorized by information source and analysis strategy, including host or network data, signatures, specifications, anomalies, and machine learning.
- Security evaluation: The review relates IDS threat models, input data, and techniques to specific attacks, while using testbeds to address dataset shortages and deployment constraints.
- Testbeds: Testbeds are classified as physical, virtual, virtual-physical, probabilistic-model-based, software, and hybrid implementations.
3 SCADA System Architecture
SCADA architecture evolved from isolated, proprietary systems to distributed, networked, and IoT/cloud-based designs. This progression improves interoperability, scalability, and deployment efficiency while expanding communication and security considerations.
- SCADA components: SCADA combines RTUs, MTUs, sensors, actuators, HMI, Historian, and communication links to monitor and control physical processes.RTUs collect sensor data and forward it to the MTU; HMI presents operational information, while the Historian stores data, events, and alarms.
- SCADA generations: Monolithic SCADA systems operated in isolated environments using proprietary protocols that restricted interoperability between vendors.RTUs communicated with MTUs over WANs, and backup systems could provide redundancy.
- SCADA generations: Distributed SCADA systems spread computation across remotely located systems on LANs, increasing processing power, redundancy, and reliability.These systems remained tied to proprietary hardware, software, protocols, and peripheral devices, with security receiving limited attention.
- SCADA generations: Networked SCADA systems use open protocols and standards across networks and WANs, supporting geographically distributed modern systems.Standardisation and cost-effective networking distinguish this generation from distributed systems based primarily on proprietary protocols.
- SCADA generations: Fourth-generation SCADA integrates IoT, cloud computing, distributed cognitive computing, and CPS to reduce infrastructure and deployment costs.The passage also describes integration and maintenance as easier than in previous generations.
- Communication protocols: Protocol choices vary by bandwidth, distance, data volume, and security: DNP3 suits long-distance links, while Modbus targets low-volume applications.Only DNP3-SA and Profibus support encryption and authentication; Modbus lacks these protections, while IEC 60870-5-101 and IEC 61850 allow authentication without encryption.
4 Taxonomy of attacks
The review classifies SCADA attacks by origin, target, impact, method, and category, showing increasing and consequential threats across critical infrastructure. Reported attacks cluster over time and sectors, while malware and sophisticated techniques remain prominent.
- Attack taxonomy: SCADA attacks can cause financial loss, system damage, production loss, denial of service, latency, or intellectual loss across critical infrastructures.
- Attack taxonomy: The review classifies attacks into malware, non-cyber attack, unauthorised remote access, interruption of service, and unknown categories.
- Temporal analysis: 91 attacks were reported during 2008–2012, while 2003 recorded the highest single-year count at 36, mostly due to malware.
- Sector analysis: 48 attacks targeted transportation and 46 targeted power and utilities, the two most affected application sectors in the review.
- Attack categories: Approximately 28% of reported attacks were attributed to malware, while unauthorised access was also a frequent cause.
- Evolving threats: Modern attackers increasingly use sophisticated techniques, although field-device firmware remains less studied than HMIs and communication protocols.
5 Intrusion Detection Systems
The review surveys SCADA intrusion detection by information source and analysis strategy, covering host, network, signature, anomaly, specification, and machine-learning approaches. It highlights dataset scarcity, resource constraints, and reported strengths of network and probabilistic methods.
- IDS foundations: IDSs monitor host or network events, analyse them for unusual incidents, and notify administrators when security violations are detected.
- Data limitations: SCADA IDS research is constrained by the lack of comprehensive attack datasets, requiring researchers to create or preprocess data for evaluation.
- Information source: HIDS uses host activity such as filesystem changes and logs, whereas NIDS analyses traffic generated by networked devices.
- Information source: NIDS are generally preferred in SCADA networks because resource-constrained SCADA components cannot support HIDS sensors.
- Analysis strategy: Signature detection matches traffic against stored misuse patterns, while anomaly detection compares current traffic with learned normal behaviour.
- Analysis strategy: Anomaly detection can identify zero-day attacks but may produce false alarms because modelling general behaviour accurately is difficult.
- Machine learning: Probabilistic model-based detection distinguishes normal from critical states using unsupervised clustering and achieved 98% average precision across eight databases.
6 Testbeds for SCADA system
The review compares physical, virtual, virtual-physical, and hybrid SCADA testbeds by replication strategy, fidelity, cost, reliability, and scalability. Testbeds address limited operational data and the risks of evaluating IDSs on live critical infrastructure.
- Testbed taxonomy: SCADA testbeds are categorised as physical, virtual, virtual-physical, or hybrid according to their replication strategies.
- Research motivation: Testbeds are important because live SCADA systems cannot safely tolerate shutdowns or delays, while validated operational data are scarce and access to expensive facilities is restricted.
- Physical testbeds: Physical testbeds closely represent real systems but face substantial hardware, maintenance, scalability, and cost demands.
- Virtual testbeds: Virtual testbeds isolate experiments from physical devices, abstract hardware and software, and provide configurable controlled environments.
- Virtual-physical testbeds: Virtual-physical testbeds connect control devices with computer models, producing more realistic and cost-effective measurements, latencies, and communication patterns.
- Hybrid testbeds: Hybrid testbeds combine simulated, virtualised, emulated, and physical devices, including configurations for cybersecurity scenarios such as Modbus worm attacks.
- Testbed selection: Hybrid testbeds are preferred because they offer good accuracy and cost-effectiveness, while physical and virtual alternatives trade fidelity against expense and reliability.
7 Recent advances in SCADA
Recent SCADA advances integrate cloud computing and IoT to improve scalability, flexibility, and automation, while introducing security, privacy, performance, and reliability concerns.
- Sensor-cloud SCADA addresses the inflexibility, centralization, and limited interoperability of traditional frameworks.
- VS-Cloud proposes dynamic sensing-service management with privacy, scalability, fault tolerance, interoperability, and energy-awareness goals.
- Cloud and IoT integration is reshaping SCADA through interconnected sensors, intelligent devices, data analysis, process control, monitoring, and reporting.
- Integrating traditional SCADA with IoT remains more vulnerable to security threats because traditional systems cannot properly measure security parameters.
- Cloud services offer real-time monitoring, pay-per-use licensing, and lower capital and operating expenses, while providers manage maintenance and upgrades.
- Cloud-SCADA introduces security and performance risks, including information leakage, latency, privacy concerns, unreliable servers, man-in-the-middle attacks, and denial-of-service attacks.
8 Future Research Directions
The paper identifies research priorities for closing SCADA security gaps, emphasizing better attack data, scalable validation environments, improved intrusion-response techniques, and secure communication protocols.
- Attacks Database: A publicly available global repository of SCADA security incidents is needed because existing datasets are outdated, nonspecific, or incomplete.
- Scalable Testbeds & validation techniques: Current SCADA testbeds lack a cost-efficient, scalable, and high-fidelity solution.
- Intrusion Detection and Response: Alert post-processing, alert correlation, honeypots, and honeynets are proposed to reduce false positives, connect multistep intrusions, and delay intrusion impact.
- New Communication Protocol: Future IoT-cloud SCADA communication protocols should be reliable, secure, scalable, open, and low latency, with application- and network-layer security integrated.
9 Conclusion
The review connects SCADA architectures, attacks, intrusion detection, testbeds, and emerging cloud-based systems to assess security gaps. It concludes that substantial improvements remain necessary in detection, validation, testbed design, and cloud-SCADA architectures.
- Modern Internet-connected SCADA systems are sophisticated open systems whose reported attacks vary in impact and severity.
- Underreporting and potentially life-threatening consequences create an urgent need for SCADA security and responsive intrusion detection.
- Cryptographic approaches were excluded from the review because resource-constrained SCADA devices can make them inappropriate.
- The review links SCADA security aspects and provides a structured, multidimensional overview spanning architecture, vulnerabilities, attacks, intrusion detection, and testbeds.
- IoTization and cloud-based SCADA broaden the research problems associated with securing SCADA systems.
- Intrusion detection requires improvement in placement policy, validation strategy, attack coverage, latency, and false-positive rate.
- Testbeds require improvements in cost, scalability, and fidelity, while cloud-based SCADA architectures must address high latency and low bandwidth.