Securing WirelessHART: Monitoring, Exploring and Detecting New Vulnerabilities

Industrial Control Systems are now exploring the use of Internet of Things technologies not only to make them fitter to their job but also to explore the advantages that come from connecting them to the Internet. Nevertheless, with this paradigm shift, new threats appear, of which the stuxnet worm is just an example, and Intrusion Detection Systems architectures and solutions were and still are being considered. However, most existing projects concentrate on high level system aspects and thus neglect security aspects at wireless communication standards level, such as WirelessHART (the standard with largest market share), choosing not to address security solutions to common, known attacks identified by the community. In this paper, using a monitoring architecture proposed in our previous work, we will monitor a WirelessHART testbed, and at the same time, conduct network attacks from an outsider perspective. As main contributions this paper presents a new exhaustion attack for WirelessHART that, until now, to the best of our knowledge, has not been yet described. Additionally, the presented work proves that using classifiers like One Class Support Vector Machines (OSVM), and our monitoring architecture we are capable to detect the new exhaustion attack and more common attacks like jamming and collision.