SCADApedia
AAA  AAA 

IDS Signatures

Digital Bond developed SCADA IDS signatures thanks to the generous funding from the Department of Homeland Security (DHS) and Lurhq, an MSSP. These signatures identify possible attacks through protocol fuzzing, unauthorized SCADA communication, and use of protocol that is rare and extremely dangerous if misused.

The current signatures just scratch the surface on what is possible. There are more signatures needed for the existing protocols and many more protocols that we have not addressed yet. If you would like to fund additional SCADA signature development please contact info@digitalbond.com.

The signatures were developed for Snort, which calls signatures rules. The complete release package includes the signatures, config and reference files, sample data for each signature and a helpful overview document.

Click here to download the complete SCADA IDS package

Documentation for the signatures was written in detail in the Snort format and is linked by the provided Snort reference file. The links below will provide an overview of the signatures by protocol and links to each signatures documentation page.

The signatures have been integrated into most commercial IDS products including products from Cisco, Fortinet, ISS, Juniper, McAfee and Symantec. The SCADA signatures are available from these vendors in the same manner as any other signature update.

Comments

Pingback from Digital Bond » IDS Signature Release 3.3
Time: October 20, 2008, 7:22 am

[...] can download the complete IDS package that is now on Release 3.3. The package includes the signatures files by category, configuration files, and test data to [...]