TSNZeek: An Open-source Intrusion Detection System for IEEE 802.1 Time-sensitive Networking

03/20/2023

∙

IEEE 802.1 Time-sensitive Networking (TSN) standards are envisioned to replace legacy network protocols in critical domains to ensure reliable and deterministic communication over off-the-shelf Ethernet equipment. However, they lack security countermeasures and can even impose new attack vectors that may lead to hazardous consequences. This paper presents the first open-source security monitoring and intrusion detection mechanism, TSNZeek, for IEEE 802.1 TSN protocols. We extend an existing monitoring tool, Zeek, with a new packet parsing grammar to process TSN data traffic and a rule-based attack detection engine for TSN-specific threats. We also discuss various security-related configuration and design aspects for IEEE 802.1 TSN monitoring. Our experiments show that TSNZeek causes only 5 detects various threats in a real TSN testbed.

READ FULL TEXT

TSNZeek: An Open-source Intrusion Detection System for IEEE 802.1 Time-sensitive Networking

Database Intrusion Detection Systems (DIDs): Insider Threat Detection via Behavioural-based Anomaly Detection Systems – A Brief Survey of Concepts and Approaches

Towards Developing Resilient and Service-oriented Mission-critical Systems

Evaluation of Network Based IDS and Deployment of multi-sensor IDS

Period Adaptation for Continuous Security Monitoring in Multicore Real-Time Systems

Adaptable Plug and Play Security Operations Center Leveraging a Novel Programmable Plugin-based Intrusion Detection and Prevention System

RIDS : Real-time Intrusion Detection System for WPA3 enabled Enterprise Networks

DoS Protection through Credit Based Metering – Simulation Based Evaluation for Time-Sensitive Networking in Cars

TSNZeek: An Open-source Intrusion Detection System for IEEE 802.1 Time-sensitive Networking

Related Research

Database Intrusion Detection Systems (DIDs): Insider Threat Detection via Behavioural-based Anomaly Detection Systems – A Brief Survey of Concepts and Approaches

Towards Developing Resilient and Service-oriented Mission-critical Systems

Evaluation of Network Based IDS and Deployment of multi-sensor IDS

Period Adaptation for Continuous Security Monitoring in Multicore Real-Time Systems

Adaptable Plug and Play Security Operations Center Leveraging a Novel Programmable Plugin-based Intrusion Detection and Prevention System

RIDS : Real-time Intrusion Detection System for WPA3 enabled Enterprise Networks

DoS Protection through Credit Based Metering – Simulation Based Evaluation for Time-Sensitive Networking in Cars