MITRE ICS simulation and intrusion detection on ethercat based drinking water system

Industrial control systems are complex systems due to the technology and protocol diversity they contain. However, since there are critical systems, the destruction effect is equally great in any possible attack. Therefore, the protection and traceability of critical infrastructures against cyber attacks are important and necessary. OT, which has an EKS operating structure, has different performance and security requirements than the standard IT infrastructure. EKS systems consist of field devices where operational processes take place and control systems that provide management of these devices. Attackers are involved in the whole process after gaining access from the control layer. As a result, critical infrastructure systems are threatened by cyber attacks. Therefore, continuous monitoring and security audits are also a necessary process for critical infrastructures. In this study, studies on cyber attack and detection system were carried out on water management process, which is one of the critical infrastructures. On the EtherCAT based water management process, 6 different attack vectors for field devices were developed in accordance with the techniques in the MITRE ICS ATT&CK matrix, and these attacks were separated by data obtained from network traffic and determined by the SVM algorithm. Attack scenarios were created by selecting 7 different techniques in the MITRE ICS ATT&CK matrix for attacks on the SCADA system in the control center via the engineering computer on the same process. Wazuh HIDS was used for the intrusion detection system for the SCADA system. Visualization of both attacks was done on ELK. Keywords: Industrial control systems, Intrusion detection system, MITRE ICS ATT&CK Matrix